Rule 1 of writing secure code: You must sanitize your user input.
At the very least pass
-- into you mkdir clause to prevent manipulating switches.
Currently it could be used to create directories in arbitrary locations with arbitrary permissions.
In of itself, it probably wont lead to a breach but you could pass stuff like:
-m 0777 /var/lib/mysql/newdb
To create a a new mysql database anyone could write into.
Theres also a denial of service attack to be had in here because each space is treated as a new directory.so you could pass 32760 new paths to be processed.
Finally, some pseudo filesystems are sensitive to new directories in ways you might not expect. On fedora for example directories like
/sys/fs/cgroup/newcgroup could create a new cgroup. Also in the LIO subsystem writing directories into
/sys/kernel/config/target could be used to export a block device over an iscsi network (then the whole contents of your device could be copied).
So, no dont do this.