use CGI ':standard';
use File::Spec 'rel2abs';

my $base = '/www';

my $filename = rel2abs(path_info, $base);

if ($filename =~ /^\Q$base/ && open(F, "< $filename\0") && -f F) {
   print "Content-type: application/pdf\n";   # or whatever
   print "Content-length: ", -s F, "\n\n";

   print while <F>;
   close(F);
} else {
   # handle errors, perhaps do a Status: 403 or 404
   # along with a nice description, using $! if you want
}

##</code><code>##

http://www.example.com/cgi-bin/script.pl/path/filename.pdf