Here's my complete patch for CGI.pm. The module assumes your pages and forms are always in utf8, and that you always use the OO interface of CGI.pm (which should be the case in CGI::Application).

package CGI::as_utf8;

BEGIN
{
    use strict;
    use warnings;
    use CGI;
    use Encode;

    {
        no warnings 'redefine';
        my $param_org = \&CGI::param;

        my $might_decode = sub {
            my $p = shift;
            # make sure upload() filehandles are not modified
            return ( !$p || ( ref $p && fileno($p) ) )
                ? $p    
                : eval { decode_utf8($p) } || $p;
        };

        *CGI::param = sub {
            my $q = $_[0];    # assume object calls always
            my $p = $_[1];

            # setting a param goes through the original interface
            goto &$param_org if scalar @_ != 2;

            return wantarray
                ? map { $might_decode->($_) } $q->$param_org($p)
                : $might_decode->( $q->$param_org($p) );
            }
    }
}

1;
[download]

Usage is simple. Just add a use CGI::as_utf8; in your CGI::Application module(s). It's been battle-tested on a site that does about 7 million cgi hits per day, so it works in practice. Suggestions for improvements are welcome though!