Having . in your $PATH isn't a major security issue on its own. I'd classify it at S3. The problem with S3s though, is that two separate S3s can combine to cr

Having . in your $PATH isn't a major security issue on its own. I'd classify it at S3. The problem with S3s though, is that two separate S3s can combine to create an S1 or an S0, which can bite you. If you've had . in your PATH for a long time and never had a problem with it, it's either because there isn't anything else open that makes this an issue (fairly likely), or that no one's really bothered to exploit your system (also fairly likely)