Hi,
Files go into the /Data/Sites/1/ and its sub folders by design. Its not a bug.
mojoPortal supports hosting multiple sites in the same installation so we keep files separated per site.
So all files uploaded go into /Data/Sites/[SiteID]/ and its sub folders. 1 just happens to be the SiteID of the first site.
The Data folder and its sub folders are the only folders where the web process needs permission to write files. All other fles and folders can be read only.
Hope it helps,
Joe