You might be able to use a config reader and look at the upload path in CE's conifg file. But I don't think that the CE object exposes that as a property that you can work with in code. Could be wrong tho.