diff -r 244caf2ade0e Lib/CGIHTTPServer.py
--- a/Lib/CGIHTTPServer.py	Tue Oct 29 16:24:26 2013 -0400
+++ b/Lib/CGIHTTPServer.py	Tue Oct 29 17:10:03 2013 -0400
@@ -100,28 +100,27 @@ class CGIHTTPRequestHandler(SimpleHTTPSe
 
     def is_python(self, path):
         """Test whether argument path is a Python script."""
         head, tail = os.path.splitext(path)
         return tail.lower() in (".py", ".pyw")
 
     def run_cgi(self):
         """Execute a CGI script."""
-        path = self.path
         dir, rest = self.cgi_info
 
-        i = path.find('/', len(dir) + 1)
+        i = rest.find('/')
         while i >= 0:
-            nextdir = path[:i]
-            nextrest = path[i+1:]
+            nextdir = rest[:i]
+            nextrest = rest[i+1:]
 
             scriptdir = self.translate_path(nextdir)
             if os.path.isdir(scriptdir):
                 dir, rest = nextdir, nextrest
-                i = path.find('/', len(dir) + 1)
+                i = rest.find('/')
             else:
                 break
 
         # find an explicit query string, if present.
         i = rest.rfind('?')
         if i >= 0:
             rest, query = rest[:i], rest[i+1:]
         else:
diff -r 244caf2ade0e Lib/test/test_httpservers.py
--- a/Lib/test/test_httpservers.py	Tue Oct 29 16:24:26 2013 -0400
+++ b/Lib/test/test_httpservers.py	Tue Oct 29 17:10:03 2013 -0400
@@ -391,16 +391,21 @@ class CGIHTTPServerTestCase(BaseTestCase
         # The shebang line should be pure ASCII: use symlink if possible.
         # See issue #7668.
         if hasattr(os, 'symlink'):
             self.pythonexe = os.path.join(self.parent_dir, 'python')
             os.symlink(sys.executable, self.pythonexe)
         else:
             self.pythonexe = sys.executable
 
+        self.nocgi_path = os.path.join(self.parent_dir, 'nocgi.py')
+        with open(self.nocgi_path, 'w') as fp:
+            fp.write(cgi_file1 % self.pythonexe)
+        os.chmod(self.nocgi_path, 0777)
+
         self.file1_path = os.path.join(self.cgi_dir, 'file1.py')
         with open(self.file1_path, 'w') as file1:
             file1.write(cgi_file1 % self.pythonexe)
         os.chmod(self.file1_path, 0777)
 
         self.file2_path = os.path.join(self.cgi_dir, 'file2.py')
         with open(self.file2_path, 'w') as file2:
             file2.write(cgi_file2 % self.pythonexe)
@@ -409,16 +414,17 @@ class CGIHTTPServerTestCase(BaseTestCase
         self.cwd = os.getcwd()
         os.chdir(self.parent_dir)
 
     def tearDown(self):
         try:
             os.chdir(self.cwd)
             if self.pythonexe != sys.executable:
                 os.remove(self.pythonexe)
+            os.remove(self.nocgi_path)
             os.remove(self.file1_path)
             os.remove(self.file2_path)
             os.rmdir(self.cgi_dir)
             os.rmdir(self.parent_dir)
         finally:
             BaseTestCase.tearDown(self)
 
     def test_url_collapse_path(self):
@@ -463,16 +469,20 @@ class CGIHTTPServerTestCase(BaseTestCase
                                  msg='path = %r\nGot:    %r\nWanted: %r' %
                                  (path, actual, expected))
 
     def test_headers_and_content(self):
         res = self.request('/cgi-bin/file1.py')
         self.assertEqual(('Hello World\n', 'text/html', 200),
             (res.read(), res.getheader('Content-type'), res.status))
 
+    def test_issue19435(self):
+        res = self.request('///////////nocgi.py/../cgi-bin/nothere.sh')
+        self.assertEqual(res.status, 404)
+
     def test_post(self):
         params = urllib.urlencode({'spam' : 1, 'eggs' : 'python', 'bacon' : 123456})
         headers = {'Content-type' : 'application/x-www-form-urlencoded'}
         res = self.request('/cgi-bin/file2.py', 'POST', params, headers)
 
         self.assertEqual(res.read(), '1, python, 123456\n')
 
     def test_invaliduri(self):