First, you should check the return value of CGI::Session->new. That's kinda important.

The second is your call should look something like:

use CGI;
use CGI::Session;
use File::Spec;

my $cgi = CGI->new;
my $session = CGI::Session->new( undef, $cgi, { Directory => File::Spe
+c->tmpdir } )
    or die "Cannot create \$session!\n";
[download]

/tmp isn't portable. :-)