You could probably just try making it and if it succeeds it's valid.

use File::Path;
eval { mkpath([...args...]) };
# deal with failure or succes
[download]

However, I'm with graff. You should whitelist the smallest set of input you'll allow first -- like [-_a-z/] -- and pass it through Path::Class or something to normalize it, or you'll eventually end up with a bad surprise given enough user input.