In answer to your first question, your file uploads are almost certainly arriving via STDIN, and the first time you new CGI, it reads all of STDIN. The second time you new CGI, there's nothing left on STDIN for it to read, so it doesn't see the file contents.

Besides STDIN, CGI also gets parameter information from %ENV (see perlvar), which doesn't change after being read.

In answer to your second question, you basically have to make sure to create only one CGI object, which every module will use. A simple singleton package can accomplish this:

package My::CGI;

use CGI;
my $cgi;

sub cgi {
    $cgi ||= CGI->new();
    return $cgi;
}
__END__
# use this way:
use My::CGI;
my $cgi = My::CGI->cgi();
[download]