The CGI module uses a temporary file for the file upload. Sounds like your problem is with permissions (or something similar) dealing with the temporary files it needs to create. See the -private_tempfile section of the CGI module docs for more details on how to set the temp file directory.