use the DNN webupload control instead, that also cares for DNN security and secure folders.

Is the "submit" button contained within an AJAX update panel or have you enabled "Supports Partial Rendering" in the module control's definition? If so, note that for a file to be uploaded, a FULL postback is required. If this is the case, it is possible to force the "submit" button or whatever button you have designated to trigger the actual upload (after the file has been selected with the FileUpload control) to perform a full postback. Include the following line of code in your Page_Load event handler:

              Framework.AJAX.RegisterPostBackControl(btnUpload)

where btnUpload is a reference to the button which triggers the upload.

You might be interested in taking a look at the image upload AND editing control on which I have been working occasionally for the past several months.  A demonstration of a rather early version may be seen at: http://www.wesnetdesigns.com/Projects/ImageEditor/tabid/114/Default.aspx

I am now in the processing of wrapping the editor control in a DNN aware custom server control which will mimic many of the properties of the DNN UrlControl (which is the one that I believe Sebastian referred to) as they relate to user/role permissions and secure storage.  I had run into a few problems with state persistance when switching in and out of editor mode but now have most of them solved.  I also plan to wrap the same upload and editor functions into a custom PropertyEditorControl. Both will be made freely available to the DNN community.