I noticed that the request processor in OpenACS 4.x inhibits access to to cgi scripts outside the page root. 
Here's the relevant section of my nsd configuration file:
# 
# CGI interface -- nscgi, if you have legacy stuff. Tcl or ADP files inside 
# AOLserver are vastly superior to CGIs. I haven't tested these params but they
# should be right.
# 
ns_section "ns/server/${server}/module/nscgi" 
    ns_param   map                "GET  /cgi-bin/ ${serverroot}/$server/cgi-bin"
    ns_param   map                "POST /cgi-bin/ ${serverroot}/$server/cgi-bin" 
    ns_param   Interps            CGIinterps
ns_section "ns/interps/CGIinterps" 
    ns_param   .pl                "/usr/bin/perl"
Instead of executing the cgi script, the request processor redirects the request to the virtual url handler. Only with a link under the page root to the cgi-bin directory (outside the page root) are the scripts executed.
Is this the intention or am I missing something?