I was checking authentication using CGI::Session and creating a $cgi object with it.
Apparently, if you have form data and don't use the first CGI object you create you lose the upload, but retain all the additional data.
Learn something new every day. I've been creating multiple CGI objects for years without any problems. From now on i'll create just one and pass it around to functions as needed.