Looking at your stack trace it appears that your servlet engine (Catalina = Tomcat, correct?) is attempting to duplicate the session between multiple instances using serialization. In the process it finds a CommonsMultipartRequestHandler$CommonsFormFile object that cannot be serialized.
Are you saving your form that contains the FormFile on the session? What if you configured this action to use request scope?