Does the file necessarily have to be stored on the server? I wouldn't rely on the user to delete the file. When you use CGI.pm, you get the uploaded data with a filehandle you read from like

while (<$upload_fh>) {
    $file_contents .= $_;
}
[download]

Why do you need to store the file at all? Anyway, CGI.pm temporarily stores uploaded files in a /tmp directory (look for the -private_tempfiles "pragma" in `perldoc CGI`).