The remove_dir_all Rust crate had a race condition vulnerability allowing an attacker to trick a privileged process into deleting unintended privileged files via symlink manipulation during recursive directory deletion. This Time-of-check Time-of-use (TOCTOU) flaw could cause deletion outside the intended directory tree. The issue is mitigated in version 0.8.0 by using file-handle relative operations to prevent directory hierarchy manipulation during deletion. However, the initial entry path remains a challenge and requires careful handling by calling code to avoid race conditions. Unprivileged processes are not affected beyond existing risks.