To make this useful for future viewers (since @Community bumped it anyhow), I'll answer with the relevant bits of what OP (who hasn't been here since January 20th) edited into the question.
Here's what happened:
We had some Python scripts available to the web, at /aux/file.py,
which were not surprisingly at /var/www/http/aux . Separately, we were
running an app server and Apache proxies through at /servlets/. A
contractor had constructed the WAR file by bundling up all the
generated files including the Python files (which are in a directory
also called aux, not surprisingly), so if you typed in
/servlets/aux/file.py, the web-server would ask the app-server for it
and the app-server would just supply the file. It was the latter URL
that this morning I happened to type in by accident and lo, the source
Until I realized the shear unlikelihood of what I had done, the
situation was rating about 8.3 on the sphincter scale. After a tense
half-hour or so I realized that it had nothing to do with the CGI (and
that serving files that were also executable would be not only foolish
but also impossible), and was able to address the real problems.