My current solution is using open my $fh, '>', 'output.txt';, and I was told can't do it this way, as it saves the file automatically and it's not allowed for security reasons :/.

Using open in a CGI writes to the SERVER'S filesystem. No download at all. If a user clicks a download link/button, the resulting file is downloaded and written to the CLIENT'S filesystem, using the web browser to access the filesystem.

Of couse, you do not want to allow the user to set filenames on the server's filesystem, that opens huge security holes.

If you can't keep all data in RAM in your CGI, use File::Temp, that takes care of searching a safe place for temp files on the server AND cleans up after you.

Alexander