Right, the body of the request can be accessed via CGI. I used $cgi->param('POSTDATA') to save the uploaded file.