Arbitrary file overwrite via predictable buffer filename

Insecure temporary file handling in Rapid7 Velociraptor before 0.6.5-2 allows local users to overwrite files through a symlink. The client buffers undelivered data in a restricted local file whose predictable path is stored in configuration, then follows a replacement symlink when writing. Exploitation requires local filesystem access and timing the replacement on macOS or Linux; the write occurs with the client's privileges and can corrupt a chosen file.