The problem is with File::Path; it's unlinking things based on names that it got from readdir, and the output of readdir is tainted.

Of course, it's unlikely that this is a security hole, but apparently no one has bothered to fix it. It was discussed in the perl porters mailing list back in '98 and '99; you can DejaGoo for (taint File::Path) and find quite a bit of discussion.