This probably has to do with paths and permissions. The cgi script runs as the web server user (like nobody or apache), while you run as a regular user. The web server user is usually purposely limited to a fixed path (maybe no path at all) and owns only files specifically assigned to it.

The solution is usually to specify a full path like:

/usr/local/bin/executable
[download]

and to make sure that the web server user can read and execute that file. Then ask yourself whether that script could do anything to harm your system.

Phil