You could write a Perl script that verifies the uploaded files are actually image files and sets permissions on them if they pass or deletes them if they fail. You don't need to give 777 access to the upload directory at all, just make sure that whatever user is running your CGI scripts has read/write permission (6) to the directory.

Just out of curiosity, why don't you want the images to be stored in the database as BLOBs?

- - arden.