I probably know the answer to this but just making sure: The CGI directory must be within the root directory, and if so, we are responsible for checking if the path given by the user is inside the root directory path on server start? Thanks, Rob