Are you sure this is what you want?

my ($username, $imagename) = $ENV{REQUEST_URI} =~ /\/(.*)\/(.*)/;
[download]

The reason I'm asking is because you need to consider the following input possibilities:

""
"/"
"//"
"///"
"/a/b"
"/a/b/"
"/a/b/c"
"/a/b/c/"
"a//"
"a/b/"
...

You see, your regex would match any string with 2 or more slashes no matter where they occur. Also, you have a greedy * which will match the longest string.

Example: "/a/b/c/d/e" => $user = "a/b/c/d", $img = "e" which may not be what you want.

You may need to put more constraints on the check. I think the regex you're looking for is in the neighbourhood of:

my ($user, $img) = $ENV{REQUEST_URI} =~ m#^/([^/]+)/([^/]+)$#;
[download]

It may look more complex than your original regex, but should do the job. Of course, look at perlre for all the details.

Hope this helps,,,

Update: If you're using $user as a directory name, beware of people passing it "/../something" as that would open a door for people to access other information.