Some hosting providers require you to create files and directories under your personal account and restrict them for anyone else. Others require files to be writeable by some kind of an "apache" user.
There are
general instructions, but you should consult with your hosting provider what are the secure file permissions for your server.
One more thing to consider is that when upgrading X-Cart 5 overwrites files on the server, so the user that runs PHP scripts must have enough permissions to do so.