How about a message action where you consume an HTML
<input type="file"> form variable value and the message action would contain a path field to upload the file to from the root of the DNN instance and an optional SQL execute box to insert the full path and file name into a record field value? The path field would of course be able to consume ListX values to be able to dynamically create the file path.

The action would need to be able to create the folder structure on the fly if it didn't exist based on a checkbox in the action that determined if file subfolder creation was permitted.