Uploaded Private files access problems
Although and older issue, it's worth noting that system/files is normal for Drupal private file mode paths.

That is because system/files is the logical application path that handles and routes to the file on the actual file system.

It is this logical path that allows the additional authentication checks that private file mode allows.

You can put your private files under sites/default/files/private and Drupal will automatically create an .htaccess file to deny direct web access to them.

However, for safety, it's recommended to put your private files directory outside the html web root. For example, one level up from your website document root, or some other designated folder.

If curious private files are served via system_menu which defines the system/files url callback to file_download.

Following that hook_file_download is used to provide access control to the requested private file.