that's right, a temp folder or a temp db table that would store that data will do the job.
In the case of a temp folder I would create a subdirectory for the session (that is, directory name = session id) and create script that would be fired up at the end of the session. The end of the session would mean: 1. The user has submitted the form, action: move the valid data to the designated location and delete the temp subdirectory; 2. the user left without completing the form properly or in a timely manner (= session timeout), delete the temp subdirectory.
As to a db table, it depends on you app design whether or not this would be more sensible.
You may also want to take a look at these answers:

PHP - Store Images in SESSION data ??? - Stack Overflow
I would also advise against storing images in the session variable.