I've had trouble with this too. The solution I found was to use the upload() method to get a filehandle:

my $filename = $query->param('filename');
my $fh = $query->param('file');

# clean $filename, especially in Taint mode

open(OUTPUT, '>' . $path . $filename) or carp "Can't open $filename: $
+!";
select(OUTPUT);
print while (<$fh>);
[download]

Ugly, demo code, but that technique worked in my tests. See Re: CGI.pm file upload freaking me out for more information.