Just to amplify this, the current working directory of the script is determined by how the web server runs the script. It sounds like your webserver (in its current configuration) sets the current working directory to be the same as the location of your script. It also sounds like you don't have taint checking turned on.

I suggest you add use lib so that your script will continue to work if something changes in the web server configuration that affects what current working directory your script receives when it runs.

I also suggest that you make a test version of your script and turn on taint checking for it and then fix any problems that are reported.

        - tye (but my friends call me "Tye")