This bug was previously documented in
POLICY-2853, but never fixed.
The code takes in a request parameter and stores it in a global variable:
Thus if two users upload at the same time, one userId may overwrite the other.
An appropriate fix would be to use userId param only for this request if specified, otherwise use the upload-userid command line param specified at apex-editor startup. This will work as ApexFiles.js sets the userId param for each upload request: