Secure File Download from a path outside of website root

I succeeded with the correct values for my second form. What doesn’t work is that the second submit does not transfer the POST Values to the download.php file.

This is how my forms look like:

<form role="form" dmx-bind:id="form2_{{$index}}" method="post" dmx-bind:name="form2_{{$index}}" action="../../../dmxConnect/api/Kundenportal/Dokumente/naviDokumenteDownload.php" is="dmx-serverconnect-form" id="NaviAktPersDownload" dmx-on:success="formDownloadPers.submit()"><input name="dokid" type="hidden" id="hiddenFieldPers" dmx-bind:value="DokumentId"><button type="submit" class="pull-right btn btn-sm btn-default-transparent btn-animated" name="download" value="Dokument laden">Dokument laden<i class="fa fa-download"></i></button></form><form id="formDownloadPers" role="form" method="post" action="../../../download.php">
<input id="DateiPfad" name="DateiPfad" type="hidden" dmx-bind:value="NaviAktPersDownload.data.dokumenteDownload[0].DateiPfad"><input id="Dateiname" name="Dateiname" type="hidden" dmx-bind:value="NaviAktPersDownload.data.dokumenteDownload[0].Dateiname">

FYI DateiPfad = Path, Dateiname = Filename

Any idea?

Here is a screenshot of my current download.php