my $path = File::Spec->catfile($dir, $file);
open(OUT, '>', $path) or die;
[download]

Another check is to remove any directory components. This prevents writing to files elsewhere on the filesystem. It guarantees that the files go in the right directory.

It is a good idea to separate uploaded files into their own directory. If there is some authentication to control who can upload, then overriding an existing file isn't a security hole.