From the Spreadsheet::WriteExcel docs (new):

"You can also pass a valid filehandle to the new() constructor. For example in a CGI program you could do something like this:

binmode(STDOUT);
my $workbook  = Spreadsheet::WriteExcel->new(\*STDOUT);
[download]

The requirement for binmode() is explained below. See also, the cgi.pl program in the examples directory of the distro."

My current solution is using open my $fh, '>', 'output.txt';, and I was told can't do it this way, as it saves the file automatically and it's not allowed for security reasons :/.

Using open in a CGI writes to the SERVER'S filesystem. No download at all. If a user clicks a download link/button, the resulting file is downloaded and written to the CLIENT'S filesystem, using the web browser to access the filesystem.

Of couse, you do not want to allow the user to set filenames on the server's filesystem, that opens huge security holes.

If you can't keep all data in RAM in your CGI, use File::Temp, that takes care of searching a safe place for temp files on the server AND cleans up after you.

Alexander