You need to have executable permission on the directory, otherwise the user ('nobody') can't change into the directory to write stuff there (even if write permissions is set). This should fix it:

  chmod ug+x /your/webroot/path/upload
  chmod o-rw /your/webroot/path/upload    # this is optional, but advi
+sable
[download]

Ultimately, needs to look like this (assuming both lines from above are run):

  [root@localhost upload]# ls -al
  total 56
  drwxrwx---   3 wohldad nobody  4096 Aug 24 08:51 .
  drwxr-xr-x  26 root    root    4096 Aug 22 00:41 ..
[download]