use the collapsed path in the run_cgi method (closes #19435)
diff --git a/Misc/NEWS b/Misc/NEWS
index 66a0f3e..79ab674 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -6,6 +6,11 @@
 
 *Release date: 2013-11-02*
 
+Library
+-------
+
+- Issue #19435: Fix directory traversal attack on CGIHttpRequestHandler.
+
 IDLE
 ----