diff -r 01228719b3ce -r e42a8de6d66f src/server/safs/cgi.c
--- a/src/server/safs/cgi.c	Thu Oct 30 16:59:31 2025 +0100
+++ b/src/server/safs/cgi.c	Fri Oct 31 21:15:19 2025 +0100
@@ -77,14 +77,15 @@
         }
     }
     
-    // using stat, not vfs_stat, because running scripts/executables works only
-    // with the sys fs
+    // running scripts/executables only works with the sys fs
+    // however we still use vfs_stat to run ACL checks
     if(!vfs_is_sys(rq->vfs)) {
         log_ereport(LOG_WARN, "send-cgi: VFS setting ignored");
     }
     
+    VFSContext *vfs = vfs_request_context(sn, rq);
     struct stat s;
-    if(stat(path, &s)) {
+    if(vfs_stat(vfs, path, &s)) {
         int statuscode = util_errno2status(errno);
         protocol_status(sn, rq, statuscode, NULL);
         return REQ_ABORTED;