Here is the general design pattern I would use.
Place the file upload portion of this on the last page. You cannot pass an uploaded file from page to page (and if you figure out how to do that, the security geeks will shut you down fast).
Or upload the file, generate a permanent name for it from something like the md5() of the user-id, basename and timestamp, store it in a private directory on your server, and pass this file name along from page to page in the session.