Arbitrary file overwrite via symlink path race

TOCTOU in the install utility in uutils coreutils before 0.7.0 allows local users to overwrite arbitrary files through install -D. The -D path creates parent directories by pathname, then resolves the destination again for File::create or fs::copy without anchoring either operation to a directory file descriptor. Exploitation requires concurrent write access to a destination-tree component and a privileged install invocation, enabling attacker-controlled content to replace files outside that tree.