I think your $server is tainted, because it was read from a file. You'll have to untaint it, if you want to use it in a system call (which could be dangerous).

    if ($server =~ /^((?:[a-zA-Z0-9-]+\.?)+)$/) {
        my @cupscmd=("/usr/bin/lpstat ", "-h", $1, "-r");
        my $cups_cmd=qx/@cupscmd/;
    }else{
        die "suspicious server name: $server\n";
    }
[download]

Update: changed the * in the regex to a +, to disallow empty strings