A symlink race is a timing flaw in which a program checks a file path, then an attacker changes a symbolic link before the program uses it. Because the link now points somewhere else, the program follows the wrong target. This is a classic time-of-check to time-of-use problem, and it is especially dangerous in code that runs with higher privileges than the attacker.
In cyber security, symlink races matter wherever software opens files, creates temporary paths, or reopens previously validated paths on shared systems, sandboxes, or host-guest boundaries. An attacker may use the race to overwrite sensitive files, read protected data, or redirect a trusted service to an unexpected location. Defenses include using file descriptors instead of path-based reopen operations, resolving paths safely, minimizing privileges, and performing operations atomically so the checked object cannot be swapped out between validation and use.