diff --git a/controllers/permission_upload.go b/controllers/permission_upload.go
index caee1631..6e32892b 100644
--- a/controllers/permission_upload.go
+++ b/controllers/permission_upload.go
@@ -16,6 +16,7 @@ package controllers
 
 import (
 	"fmt"
+	"os"
 
 	"github.com/casdoor/casdoor/object"
 	"github.com/casdoor/casdoor/util"
@@ -32,16 +33,15 @@ func (c *ApiController) UploadPermissions() {
 	}
 
 	fileId := fmt.Sprintf("%s_%s_%s", owner, user, util.RemoveExt(header.Filename))
-
 	path := util.GetUploadXlsxPath(fileId)
-	util.EnsureFileFolderExists(path)
+	defer os.Remove(path)
 	err = saveFile(path, &file)
 	if err != nil {
 		c.ResponseError(err.Error())
 		return
 	}
 
-	affected, err := object.UploadPermissions(owner, fileId)
+	affected, err := object.UploadPermissions(owner, path)
 	if err != nil {
 		c.ResponseError(err.Error())
 	}
diff --git a/controllers/role_upload.go b/controllers/role_upload.go
index 3365dd3c..6121da2c 100644
--- a/controllers/role_upload.go
+++ b/controllers/role_upload.go
@@ -16,6 +16,7 @@ package controllers
 
 import (
 	"fmt"
+	"os"
 
 	"github.com/casdoor/casdoor/object"
 	"github.com/casdoor/casdoor/util"
@@ -32,16 +33,15 @@ func (c *ApiController) UploadRoles() {
 	}
 
 	fileId := fmt.Sprintf("%s_%s_%s", owner, user, util.RemoveExt(header.Filename))
-
 	path := util.GetUploadXlsxPath(fileId)
-	util.EnsureFileFolderExists(path)
+	defer os.Remove(path)
 	err = saveFile(path, &file)
 	if err != nil {
 		c.ResponseError(err.Error())
 		return
 	}
 
-	affected, err := object.UploadRoles(owner, fileId)
+	affected, err := object.UploadRoles(owner, path)
 	if err != nil {
 		c.ResponseError(err.Error())
 	}
diff --git a/controllers/user_upload.go b/controllers/user_upload.go
index ae72bd28..99a5d408 100644
--- a/controllers/user_upload.go
+++ b/controllers/user_upload.go
@@ -48,17 +48,17 @@ func (c *ApiController) UploadUsers() {
 		c.ResponseError(err.Error())
 		return
 	}
-	fileId := fmt.Sprintf("%s_%s_%s", owner, user, util.RemoveExt(header.Filename))
 
+	fileId := fmt.Sprintf("%s_%s_%s", owner, user, util.RemoveExt(header.Filename))
 	path := util.GetUploadXlsxPath(fileId)
-	util.EnsureFileFolderExists(path)
+	defer os.Remove(path)
 	err = saveFile(path, &file)
 	if err != nil {
 		c.ResponseError(err.Error())
 		return
 	}
 
-	affected, err := object.UploadUsers(owner, fileId)
+	affected, err := object.UploadUsers(owner, path)
 	if err != nil {
 		c.ResponseError(err.Error())
 		return
diff --git a/object/permission_upload.go b/object/permission_upload.go
index 0a4fd96e..f085c956 100644
--- a/object/permission_upload.go
+++ b/object/permission_upload.go
@@ -33,8 +33,8 @@ func getPermissionMap(owner string) (map[string]*Permission, error) {
 	return m, err
 }
 
-func UploadPermissions(owner string, fileId string) (bool, error) {
-	table := xlsx.ReadXlsxFile(fileId)
+func UploadPermissions(owner string, path string) (bool, error) {
+	table := xlsx.ReadXlsxFile(path)
 
 	oldUserMap, err := getPermissionMap(owner)
 	if err != nil {
diff --git a/object/role_upload.go b/object/role_upload.go
index 35d382c6..e7691c06 100644
--- a/object/role_upload.go
+++ b/object/role_upload.go
@@ -33,8 +33,8 @@ func getRoleMap(owner string) (map[string]*Role, error) {
 	return m, nil
 }
 
-func UploadRoles(owner string, fileId string) (bool, error) {
-	table := xlsx.ReadXlsxFile(fileId)
+func UploadRoles(owner string, path string) (bool, error) {
+	table := xlsx.ReadXlsxFile(path)
 
 	oldUserMap, err := getRoleMap(owner)
 	if err != nil {
diff --git a/object/user_upload.go b/object/user_upload.go
index 8bdd71bd..b0e6ebf7 100644
--- a/object/user_upload.go
+++ b/object/user_upload.go
@@ -73,8 +73,8 @@ func parseListItem(lines *[]string, i int) []string {
 	return trimmedItems
 }
 
-func UploadUsers(owner string, fileId string) (bool, error) {
-	table := xlsx.ReadXlsxFile(fileId)
+func UploadUsers(owner string, path string) (bool, error) {
+	table := xlsx.ReadXlsxFile(path)
 
 	oldUserMap, err := getUserMap(owner)
 	if err != nil {
diff --git a/util/path.go b/util/path.go
index 28027930..f02648f4 100644
--- a/util/path.go
+++ b/util/path.go
@@ -34,16 +34,6 @@ func GetPath(path string) string {
 	return filepath.Dir(path)
 }
 
-func EnsureFileFolderExists(path string) {
-	p := GetPath(path)
-	if !FileExist(p) {
-		err := os.MkdirAll(p, os.ModePerm)
-		if err != nil {
-			panic(err)
-		}
-	}
-}
-
 func ListFiles(path string) []string {
 	res := []string{}
 
diff --git a/util/setting.go b/util/setting.go
index 0d13ca92..d345e775 100644
--- a/util/setting.go
+++ b/util/setting.go
@@ -14,8 +14,13 @@
 
 package util
 
-import "fmt"
+import "io/ioutil"
 
 func GetUploadXlsxPath(fileId string) string {
-	return fmt.Sprintf("tmpFiles/%s.xlsx", fileId)
+	file, err := ioutil.TempFile("", fileId)
+	if err != nil {
+		panic(err)
+	}
+
+	return file.Name()
 }
diff --git a/util/setting_test.go b/util/setting_test.go
deleted file mode 100644
index f85a4c5b..00000000
--- a/util/setting_test.go
+++ /dev/null
@@ -1,40 +0,0 @@
-// Copyright 2021 The Casdoor Authors. All Rights Reserved.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//      http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package util
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-)
-
-func TestGetUploadXlsxPath(t *testing.T) {
-	scenarios := []struct {
-		description string
-		input       string
-		expected    interface{}
-	}{
-		{"scenery one", "casdoor", "tmpFiles/casdoor.xlsx"},
-		{"scenery two", "casbin", "tmpFiles/casbin.xlsx"},
-		{"scenery three", "loremIpsum", "tmpFiles/loremIpsum.xlsx"},
-		{"scenery four", "", "tmpFiles/.xlsx"},
-	}
-	for _, scenery := range scenarios {
-		t.Run(scenery.description, func(t *testing.T) {
-			actual := GetUploadXlsxPath(scenery.input)
-			assert.Equal(t, scenery.expected, actual, "The returned value not is expected")
-		})
-	}
-}
diff --git a/xlsx/xlsx.go b/xlsx/xlsx.go
index c8ff0953..5c69613b 100644
--- a/xlsx/xlsx.go
+++ b/xlsx/xlsx.go
@@ -14,13 +14,9 @@
 
 package xlsx
 
-import (
-	"github.com/casdoor/casdoor/util"
-	"github.com/tealeg/xlsx"
-)
+import "github.com/tealeg/xlsx"
 
-func ReadXlsxFile(fileId string) [][]string {
-	path := util.GetUploadXlsxPath(fileId)
+func ReadXlsxFile(path string) [][]string {
 	file, err := xlsx.OpenFile(path)
 	if err != nil {
 		panic(err)