Save your files to the /WEB-INF folder or anywhere to your hard drive (except deployment directory of course)
I used this piece of code (it stores files for each user into it's own folder)
String path = Util.getPathToFiles() + "WEB-INF" + File.separator + "upload";
try {
path += File.separator + session.getCurrentUser().getLogin();
if (!isFolderExists(path)) {
new File(path).mkdir();
}
path += File.separator + file.getName();
FileUtils.copyFile(file, new File(path));
} catch (IOException ex) {
Logger.getLogger(ThesisBean.class.getName()).log(Level.SEVERE, null, ex);
} finally {
file.delete();
}
getPathToFiles
simply returns the realPath from ServletContext and FileUtils is class from Apache IO (but you can write your code for file copy on your own, it's just helper class)