CGI.pm uses its own hand rolled tempfile mechanism which is almost certainly the issue. See the package Fh around line 3000 of CGI.pm to see how this is hand rolled. If you are not using the HTML features then CGI::Simple gives you the same API but returns real IO::File objects which will work.

You can get the actual filename but you will have to hack into the CGI.pm object to do that. I suggest you don't. But if you want to Data::Dumper will let you see what you need to do to access the actual filename (it is under the .tmpfiles hash key in the object root). NB If $PRIVATE_TEMPFILES is set true then CGI.pm will unlink the underlying file, so you can only access it via the open handle that CGI.pm maintains.

If you want my 2c the simplest change is just to copy the file to a tmp file, make your GD:Image and unlink it. In relative terms the wait for the upload is the vast majority of the execution time, generating a tmp file is a trivial cost.