I have a cron job which chown's the directories of new users.
I take it you mean both the directories of these new users, and all the contents of those directories (i.e.
chown -R newuser:newuser /home/newuser-dir).
This is a race condition, much like in programming, except you are experiencing it at the system rather than process level, but it is still a security risk.
Mo is correct, unless you have a very strange requirement, it would be much better to use a uploading process that does not need such a background task to change file ownership.
Because in one sense you are taking unvalidated data (the uploaded file), and automatically setting the trust level to equivalent to a different, presumably a more trusted user, without necessarily ensuring the security of the files. This creates the potential for abusing this race condition, such as if the new user can create a symbolic or hard link to a system file (e.g.
/etc/shadow) so they can obtain the hashed passwords to then mount an off-line password cracking attack. That would be sad.