upload() is a newer method. If you're using a CGI.pm version earlier than 2.47 (say, from a standard install of Perl 5.005_3 or previous) you won't have it.

You can still retrieve the filehandle using param().... oh, as I see you found out. There is a danger that on failed uploads param() will return a string only (one that isn't a filehandle) so your reads will fail. Upgrade to the current CGI.pm (if you can) and use upload() to be safe.