If that means what I think, than you are having a real security risk.

Only keep the cgi-scripts themselves inside the configured CGI-bin directory or its sub-tree.

Modules and other scripts not intended to be directly callable from the World-WW have to be kept outside.

That's what use lib is for.