This issue is between security issue and enhancement... the problem occurs only in 'dev' installation of koha (but it is common). When a installation is done in 'dev' mode, the ScriptAlias in apache for the 'intranet' is the git repository in entire. In result, any file that could be executed may be launched by any user from http://intranet/cgi-bin/koha/... The file are run without arguments. The problem is important for scripts like cronjobs, that are generally resource-consuming and run without arguments. Others scripts that do more evil think may also exist... As Makefile.PL know with directories (or files) should be acceded, an htacess should be generated for here in order to allow only 'INTRANET_CGI_DIR' and 'INTRANET_TMPL_DIR'.
*** This bug has been marked as a duplicate of bug 9949 ***