diff --git a/backend/application/api/controller/Upload.php b/backend/application/api/controller/Upload.php
index 1de6e12..c5698a0 100644
--- a/backend/application/api/controller/Upload.php
+++ b/backend/application/api/controller/Upload.php
@@ -29,9 +29,10 @@ class Upload extends Api
             if (empty($files)) {
                 $this->error('未上传文件');
             }
-            $uploadPath = ROOT_PATH . 'public' . DS . 'uploads' . DS . 'temp';
-            if (!is_dir($uploadPath)) {
-                @mkdir($uploadPath, 0755, true);
+            // 临时目录使用 runtime（位于 web 根目录之外，且已对 PHP 运行用户开放写权限）
+            $uploadPath = RUNTIME_PATH . 'temp';
+            if (!is_dir($uploadPath) && !@mkdir($uploadPath, 0775, true) && !is_dir($uploadPath)) {
+                throw new Exception('上传临时目录创建失败或无写权限：' . $uploadPath);
             }
 
             $urls = [];
diff --git a/backend/deploy/cron.d/code-bang b/backend/deploy/cron.d/code-bang
index 0a7d985..5fef29f 100644
--- a/backend/deploy/cron.d/code-bang
+++ b/backend/deploy/cron.d/code-bang
@@ -13,5 +13,3 @@ PHP=/usr/local/bin/php
 # 确认收货超时（7 天自动收货）+ 订单收益解冻
 */10 * * * * nginx cd ${APP_ROOT} && flock -n /tmp/cb-demand.lock ${PHP} think demand:deal >> ${APP_ROOT}/runtime/cron/demand-deal-$(date +\%Y\%m).log 2>&1
 
-# 群聊二维码拉取更新（每日凌晨执行）
-0 3 * * * nginx cd ${APP_ROOT} && flock -n /tmp/cb-groupchat.lock ${PHP} think groupChat:fetch >> ${APP_ROOT}/runtime/cron/groupchat-fetch-$(date +\%Y\%m).log 2>&1