I don't think that's it, or at least, that's not the way it works on one Linux/Apache configuration. For one thing, $ENV{ PWD } is not even in the environment of CGI scripts (when run under Apache) in this configuration; here are the keys of %ENV, printed from within one such script:

AUTH_TYPE               HTTP_KEEP_ALIVE         SCRIPT_FILENAME
DOCUMENT_ROOT           HTTP_USER_AGENT         SCRIPT_NAME
GATEWAY_INTERFACE       PATH                    SERVER_ADDR
HTTP_ACCEPT             PERL5LIB                SERVER_ADMIN
HTTP_ACCEPT_CHARSET     QUERY_STRING            SERVER_NAME
HTTP_ACCEPT_ENCODING    REMOTE_ADDR             SERVER_PORT
HTTP_ACCEPT_LANGUAGE    REMOTE_PORT             SERVER_PROTOCOL
HTTP_CONNECTION         REMOTE_USER             SERVER_SIGNATURE
HTTP_COOKIE             REQUEST_METHOD          SERVER_SOFTWARE
HTTP_HOST               REQUEST_URI
[download]

#!/usr/bin/perl -T

use strict;
use warnings;
use CGI;
use CGI::Carp qw(fatalsToBrowser carpout);

my $q = CGI->new();
my $untaint = $q->param('untaint');
my $f       = $q->param('filename');

print $q->header, $q->start_html;
if ( $f ) {
  $f = ( $f =~ m/([\w-]+)/ )[ 0 ] if $untaint;
  if ( $f ) {
    print "Creating $f<br>\n";
    {
      my $out;
      open $out, '>', "../TRASH/$f" and close $out
        or die "Failed to create $f: $!";
    }

    print "Unlinking $f<br>\n";
    unlink "../TRASH/$f";

    print $q->h3( 'ok' );
  }
  else {
    print $q->h3( 'Bad filename: ' . $q->param( 'filename' ) );
  }
}
else {
  print $q->h3( 'Missing filename' );
}

print $q->end_html;
[download]