My upload script does

    (my $name = $filename) =~ s/^.*(\/|\\)//;

    open(UPLOAD, ">$UPLOADDIR/$name") or die "$name: $!";;
    while ( <$filename> ) {
        s/\r//g if $stripCRs;
        print UPLOAD $_;
    }
    close(UPLOAD);
[download]

where $filename corresponds to your $upfile. I suspect that you might have junk in the filename that you need to strip out.