TOCTOU Race Conditions: When Checking Isn't the Same as Doing

You check that a file exists. You open it. Between the check and the open, an attacker swapped the file with a symlink to /etc/shadow. Your code reads the wrong thing. This is a TOCTOU (time-of-check, time-of-use) bug, and it's responsible for an embarrassing number of CVEs from setuid programs to cloud APIs.