I think "values" should be an array reference:

   -values=>\@list,

As should be "defaults". A reference "refers" to an array stored in one place, meaning modifying the original array will affect subsequent actions derived from this method call -- arguments which accept an array instead of a reference copy the entire array, meaning modifying the original will not have such an effect. Also, using a reference is more efficient memory usage and speed wise particularly if the array is large.

Ps. use strict and Taint with CGI (taint may be automatic):

#!/usr/bin/perl -Tw
use strict;
[download]