In deletefiles in FDUPES prior to 2.2.0, a TOCTOU race condition allows arbitrary file deletion via a symlink.