There is, as you said, documentation in CGI about where temporary files go. You can find it with the -private_tempfiles pragma docs. It seems that if your hosting company allows use of CGI.pm they might want to make sure you can write temporary files to one of the stated places in some way. Having a read-only /tmp for example would seem to be pretty useless for its intended purpose.