Well, the list contains UploadClass items. Does that class contain any information regarding the uploading user? If not, you can't just add something to it. If so, then why would you need to add anything?
How are you expecting to know which items from the DB "belong" to the user or not?
Not sure myself -- it's been many years since I've used raw Hibernate (as opposed to JPA).
As this is a Hibernate rather than servlets question, I've moved it to the ORM forum where the Hibernate-savvy will have a better chance of seeing your question.