Now, is this behaviour an error of CGI.pm

No. You corrupt the CGI commuication before CGI.pm even sees it. STDIN is not yours to play with when using CGI.pm.

And what is the correct application design?

Tell CGI the charset you want to use for the parameters, and use binmode ':encoding(UTF-8)' on the input file handle of uploaded files when appropriate.

In this case, you don't need to use :encoding since all you do it dump the file into another file. If you do use :encoding here, you'd need it on the output file handle as well (to convert the chars back into bytes).