Your 'untaint' operation is unneeded for a hardcoded path like what you gave.

I stripped your code down to essentials:

#!/usr/bin/perl -wT
use strict;
use warnings;

use XML::Simple; # used to read the xml config file

eval {
   my $parser = new XML::Simple(keeproot => 0);
   my $config_file = "blah.xml";
   my $config_path = "/www/common/data";
   my $file= "$config_path/$config_file";

   my $_Config = $parser->XMLin($file);
   print "Content-Type: text/plain\n\n\$_config = $_Config \n";
 };
 if ($@) {
   print "Content-Type: text/plain\n\n$@\n";
 }
[download]

and created a 'blah.xml' file containing only '<data/>' and it ran fine for me.

You need to give the exact error message. I suspect it doesn't mean what you think it does.