Well, the uploads are handled by the class upload.php which will cope with the some of the security issues for you. (Evidently, allowing uploads to your server is intrinsically insecure in some ways)

So, I would add an upload attribute to a test product and see how the <input type="file"> is configured by zen cart. That will give you a starting point.

THe issue is about how you 'document' the upload. What I mean by that is storing the details about who made the upload, the file name and any other pertinent information is just as important as the actual upload? In which case there is a bit more work than simply adding an input field.