my ($image_name, $upload_dir, $file_exten) = @;
[download]

'@;' copy mistake?

UPDATE: Something else: Please post the error message

2ND UPDATE: Searching the net for 'File.pm insecure dependancy' turned up some hits

The most interesting link is a debian bug report http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=422733 suggesting that the bug was fixed in 10.0. Also it seems you can simply avoid the bug by providing absolute pathnames