Nanny comment:
Just make sure to untaint your data, of course, if you're going to pass user supplied data to the shell. Otherwise you'll be giving hax0rz an in to your server . . .

Practice safer coding:

#!/usr/bin/perl -wT
use strict;
[download]

See CGI Security and the null byte problem for more info.