No, it doesn't have to be world writable; it just has to be writable by the uid which the CGI (and/or web server) is running as. Often in shared hosting setups you can't achieve this other than by making the directory wide open, but if you've got more control it's better to avoid opening things up more than you have to.</pedant>