in reply to perl or bash in cgi scripts?

Maybe this is semantics, but last time I looked cat(1) was not a Bash built-in, it has nothing to do with Bash, it is a separate program.
$ type cat cat is /bin/cat
Recent versions of the korn shell do have a cat built-in. Perl anyway will not invoke a shell unless the command contains shell meta-characters. In your example $filename might contain meta-characters, we can't tell. You should take this into account when benchmarking, since if a shell is produced you will have two child processes instead of one.