You should read the PROCESSING A FILE UPLOAD FIELD section of CGI's docs carefully. The user's original filename for the uploaded file is retrieved by using the param method while the filehandle to the uploaded file is retrieved by using the upload method. You first assume the result of the upload method is a filename and store it in $filename. Later you treat $filename as if it is a filehandle by passing it as the first argument to read. The calls to read are successful, $filename is a filehandle (both a glob and an IO::Handle object), but the filename checking is not successful. Your upload is probably written to a file as GLOB(0xABCDEF) or something because this is the filehandle coerced into a string.