The CGI.pm docs say that the upload() method will return undef if the argument is not a valid file handle. It doesn't go into much detail about what would cause that to be the case.

One thing CGI.pm will try to do is to save the uploaded file in your temporary directory. On *nix, that's usually /tmp, but it may differ under certain setups. On Windows, depending on server software and such, c:/temp, d:/temp, c:/windows/temp, 'c:/documents and settings/user/local settings/temp' and others are all possibilities. CGI.pm may have issues if it can't do that due to permissions, so that's a good place to check.