This ...

my $rc = do($file);

... is extremely dangerous. The .cfg file is EXECUTED as Perl code. Imagine a config file containing one or more of the following lines:

$foo=`rm -rf /`;
$bar=qx/rm -rf \//;
s|(?{exec qw(rm -rf /)})||;
system 'rm -rf /';
[download]

See also: Re^2: conf file in Perl syntax, Re: reading commands from configuration file

Alexander