The CosMultipartRequestFilter parses multipart requests and stores the uploaded files in the temp folder. At the end of the request-response-loop it cleans up the temp folder by deleting the files again. Unfortunately it stores the files under their regular file name. It seems like this could be changed by providing a FileRenamePolicy, however, CosMultipartRequestFilter does not provide one.

When you have two users who upload a file named "image.jpg", not only will the upload be overwritten but as soon as the first request is done, the file will be deleted too, so the second request will then have no more file to work with.