+ is greedy and will match as many of whatever it applies to as it can. Generally it is smart to avoid . and use an explicit set of characters to match. In this case everything except / looks like it may be what you want:

$str =~ m!(.+)(/path/)([^/]+)(/.+)!
[download]

Note that I used ! as the regex delimiter to avoid having to quote all the / characters.