CVE-2026-49958: Toctou Dynamic Path Deletioncve-2026-49958-toctou-dynamic-path-deletion
Checking whether a path is a directory and conditionally deleting it using unanchored deletion methods (`shutil.rmtree`, `.unlink()`, `os.remove`) creates a Time-of-Check Time-of-Use (TOCTOU) race condition. If an attacker swaps a parent directory with a symlink between the check and the deletion call, arbitrary files and directories outside the intended bou
