It was setuid root but dropped privilege, but the dropping privilege came after parsing the command arguments and doing initialization, so there was a small tim

It was setuid root but dropped privilege, but the dropping privilege came after parsing the command arguments and doing initialization, so there was a small time window while it still runs as root and in that time it could be tricked into overriding any file.