depends upon your configuration. Usually it's in a temporary file (if you use the file driver, the default one), a database, or maybe a cookie. See CGI::Session documentation, it's all in there (but it's quite tough).
When using the file driver, you'll find in your temp directory (usually /tmp) files named SESSID13437441313 or similar, with some perl hash definition inside.