create-temporary-file generates a candidate filename, checks whether it exists, and if it doesn't, opens the file in non-exclusive, write, and truncate mode. This strategy creates a TOCTOU race and can result in the calling process being tricked into truncating files or following symlinks it shouldn't. The generated name has too little entropy to make guessing infeasible. create-temporary-file should omit the existence check and open the generated file using O_EXCL, retrying on EEXIST.
Better yet would be to call mkstemp(3), which addresses these issues and others. create-temporary-directory has a similar race, but because mkdir is always exclusive, race failures cause spurious errors instead of potentially unwanted file IO. It should retry on collision.
