$filename is being reduced without using File::Basename. In this case, the name could contain \n, so the replacement would stop too early, allowing us to have a name with slashes in it. In fact, I think a name of

"\n|/your/command/here foo bar.gif"
[download]

or whatever $theext is set to would be opened just fine. Actually, I can see that there'd be a little work to get through the maze, but nonetheless, the wrong cargo-cult code was used here, and that makes this code dangerous.

Also, the Location: header needs a space after the colon, required by RFC.

As a style issue, using File::Copy would be preferred.

-- Randal L. Schwartz, Perl hacker