Never upload files into the
Tomcat WAR directory subtree.
First of all, according to the
J2EE standard, WARs aren't unpacked, and
Java's ZIP IO API doesn't support replacing/adding single files in a WAR. So that approach only works on appservers which explode WARs. And even Tomcat only explodes WARs under certain conditions.
Secondly - and here I speak from bitter experience - if you upload files into a WAR subdirectory and someone upgrades the webapp, those files are going to get NUKED. All gone. Bye-bye. A WAR isn't something that's upgradable in parts, it's all or nothing. It's not a data directory and it was never intended to serve as a data directory. Just because you (sometimes)
can access elements in the WAR as files and directories, doesn't mean that you
should. Treat them as read-only. Because for practical purposes, they should be.
Always upload to a directory external to Tomcat and its supporting directories. Or expect the consequences.