You will have to switch STDIN to binary before reading the binary upload data. If everything in CGI.pm works as I expect, you can probably do a binmode STDIN and possibly binmode $file right before reading from $file.

By the way, I've always distrusted the use of the param() as both providing the file name and the handle. If that doesn't work, you may want to use $cgi->upload('file') to get the file handle.

#!/usr/bin/perl -CS
use CGI;
use CGI::Carp qw(fatalsToBrowser);
my $cgi = new CGI;

my $filename = $cgi->param('file');
my $fh = $cgi->upload('file');
binmode $fh;

open(OUTPUT, ">/var/www/mypath/$filename") or die $!;
while(<$fh>) {
        print OUTPUT $_;
}

print $cgi->header();
print "$file has been successfully uploaded... thank you.\n";
[download]

does not work (same error) so switching the filehandle/STDIN (I tried both) just before storing the file does not seem to be possible after giving perl the -CS switch.

update: changing binmode $fh; to binmode $fh, ":utf8"; does the trick! (Is this what you meant and does that mean I am still on the right track or is it a hint of a problem?)

• Don't use :utf8 on untrusted data. Use :encoding(UTF-8). For that matter, don't use :utf8.

• You decode bytes to chars, but you never encode the chars back to bytes when writing them. You'll get wide character warnings for non-ASCII chars, and you could get a mix of iso-latin-1 and UTF-8 characters in more complex programs.

• What awful inconsistency in your file handle names: $fh and OUTPUT? And using a global variable too?

Fixed:

...
my $fh_in = $cgi->upload('file');
binmode $fh_in, ':encoding(UTF-8)';

open(my $fh_out, '>:encoding(UTF-8)', "/var/www/mypath/$filename")
   or die $!;

while (<$fh_in>) {
   print $fh_out $_;
}
[download]

But there's absolutely no reason to convert to chars in the above code, so you'd be better off as

...
my $fh_in = $cgi->upload('file');
open(my $fh_out, '>', "/var/www/mypath/$filename")
   or die $!;

while (<$fh_in>) {
   print $fh_out $_;
}
[download]

You also mentioned binary uploads (like MP3s). For that, you'd use

...
my $fh_in = $cgi->upload('file');
open(my $fh_out, '>', "/var/www/mypath/$filename")
   or die $!;

binmode $fh_in;
binmode $fh_out;

local $/ = \4096;  # Don't wait to find "\n"
while (<$fh_in>) {
   print $fh_out $_;
}
[download]

The code for binary files also works with text files.

Because it doesn't look like it will be repaired any time soon... Let's at least warn people.

The -C flag is implemented with the unsafe ":utf8" layer instead of the safe ":encoding(utf8)" layer. Therefore, -CI, -CS, -Ci, -CD, and their numeric equivalents, are potential security risks.

Likewise, -CA is implemented by setting the SvUTF8 flag (like _utf8_on) and should also be avoided.

• Instead of -CI, use: binmode STDIN, ":encoding(utf8)";
• Instead of -Ci, use: use open ":encoding(utf8)";
• Instead of -CA, use: utf8::decode($_) for @ARGV;
• Instead of -CS, use -COE and: binmode STDIN, ":encoding(utf8)";
• Instead of -CD, use -Co and: use open ":encoding(utf8)";

Now, is this behaviour an error of CGI.pm

No. You corrupt the CGI commuication before CGI.pm even sees it. STDIN is not yours to play with when using CGI.pm.

And what is the correct application design?

Tell CGI the charset you want to use for the parameters, and use binmode ':encoding(UTF-8)' on the input file handle of uploaded files when appropriate.

In this case, you don't need to use :encoding since all you do it dump the file into another file. If you do use :encoding here, you'd need it on the output file handle as well (to convert the chars back into bytes).

#!/usr/bin/perl -COE
use CGI;
use CGI::Carp qw(fatalsToBrowser);
use utf8;
use Encode;

my $cgi = new CGI;

my $formtext = decode("utf8", $cgi->param("formtext") ); # this may be
+ abc or contain chinese
my $filename = $cgi->param('file');

my $fh_in = $cgi->upload('file');
open(my $fh_out, '>', "/var/www/clipland/www.clipland.com/$filename") 
+or die $!;

binmode $fh_in;
binmode $fh_out;

local $/ = \4096;  # Don't wait to find "\n"
while (<$fh_in>) {
        print $fh_out $_;
}

$cgi->header(-charset => 'utf-8');
print $cgi->header();
print "$filename has been successfully uploaded... Now some umlauts: ä
+öü";
[download]