I just had this same error message when calling mkdir() with a string containing a scalar which was passed to the function as an argument.

The solution was to do something similar to what File::Path does to untaint to the variable prior to the mkdir() call:

if ($tainted =~ /^([ &:#-\@\w.]+)$/) {
   $tainted = $1; #data is now untainted
} else {
   # data is bad,  log this:
   print STDERR "[TAINT] Bad Data received as \$tainted \n";
}
[download]