[...]
use CGI;
my $q = new CGI;
my $filename = $q->path_info();
$filename =~ s#^/##;
print $q->header("application/octet-stream");
die unless -f $filename;
# weitere checks auf $filename, damit keiner /etc/passwd ausliest
open FH, "<", $filename or die $!;
binmode FH; binmode STDOUT;
print while <FH>;
close FH;