The following:

use strict;
use warnings;
use CGI;
use CGI::Carp qw/fatalsToBrowser/;
my $q = CGI->new();
print $q->header(), $q->start_html("File Upload Example");
# Start a multipart form.
print $q->start_multipart_form(),
  "Enter the file to process: ",
  $q->filefield('filename','',25),
  $q->br,
  $q->reset, $q->submit('submit','Process File'),
  $q->endform;

# Process the form if there is a file name entered
if (my $file = $q->upload('filename')) {
  my $tmpfile=$q->tmpFileName($file);
  my $txt;
  while (<$file>) {
    $txt .= $_;
  }
  close($file);
  print $q->hr(), $q->h2($file),
    $q->h3($tmpfile), $q->p, $txt;
}
print $q->hr(), $q->end_html;
[download]

works for me, even for files that have a comma or & in their names. Does this also exhibit a problem for you? Perhaps there's something going wrong at the stage of writing to the local file?