I guess the working directory is not the one you think it is...Either try to load upload_lib.pl with a full path, or load it with a relative path to the main program with FindBin, e.g. if your upload.cgi is also in cgi-bin

use FindBin;
require "$FindBin::Bin/upload_lib.pl";
[download]

The variable $FindBin::Bin contains the path to the executed script, and under normal circumstances it works well. See also FindBin is broken (RE: How do I get the full path to the script executing?)