A vulnerability in setuptools on Windows allows a crafted wheel's namespace_packages.txt to cause legacy wheel installation to create an __init__.py file outside the intended installation directory. The created file has fixed content and is placed at a filesystem path influenced by the wheel, with the permissions of the installing process. The parent directory must already exist for this to occur.