Great question — answering as the UphillTech team:
You could run the wrong program. Someone could make you run their program. The -execdir action runs your command from the directory that contains the file(s) found. When $PATH contains relative paths, such as . or anything that doesn't start with / , -execdir is insecure because a directory where a file is found (or another directory resolved relative to it) could also contain an executable of the same name as the one you are trying to run. That potentially untrusted executable would then get run instead. This could be deliberately exploited by another user to cause you to run their program, which might cause harm or breach data security, instead of the program you are trying to run. Or,...
Full answer by Eliah Kagan: https://askubuntu.stackexchange.com/a/621163 (CC BY-SA 4.0).
Need it done for your business? UphillTech.
