CGI security model
CGI applications have a well-defined (but unstandardised) tradition of having the security model set by the web server. This is usually in the form of privilege dropping, although file-system jailing is popular.
Undefined (and relevant):
- What is the security policy enacted by the web server on the application?