I'll fill out some of the bits jepri left out

As it stands the code has a classic cgi security hole. It trusts user input for file system locations (e.g. ?image=/etc/passwd). Here is a safer rewrite:

#!/usr/local/bin/perl -wT

use strict;
use CGI qw/:all/;

my %images = (
    'tophat'=> {
        'path'=>"/usr/somewhere/way/out/of/reach/Top Hat.jpeg",
        'mime'=>"image/jpeg"},
    'racecar'=> {
        'path'=>"/usr/somewhere/way/out/of/reach/Bugatti.png",
        'mime'=>"image/png"},
    #etc...
);

my $query = CGI::new();
my $file = $query->param("image");

$|=1;
if (defined $images{$file}) {
    print $query->header({-type=>$images{$file}{'mime'}});}
    open ( IMAGE, $images{$file}{'path'} );
    print while ( <IMAGE> );
    close(IMAGE);
}
else {
    print $query->header({-type=>'text/html',
                          -status=>"404 File Not Found"});
}

exit ;
[download]

This is a forgiving approach to bad input, more BOFHish to log and play games.

After Compline,
Zaxo