Thanks,
I've changed the part that read

unless ($file_in =~ /^[\w][\w\._-]*$/) {
    print "Insecure file_in\n";
    exit;
}
[download]

to ...

if ($file_out =~ /^([\w][\w\._-]*)$/) {
    $file_out = $1;
}
else {
    print "Insecure file_out\n";
    exit;
}
[download]

And I also fixed the regexp that checked for double dots, from /^\.{2,}$/ to... /\.\./