A vulnerability in setuptools on Windows allows a crafted wheel's namespace_packages.txt to cause legacy wheel installation to create an __init__.py file outside the intended installation directory. The attacker can control the destination path of this file but not its contents. This occurs due to improper validation of absolute paths in namespace_packages.txt during installation. The issue affects setuptools versions >=1.38.0 and <2.30.0_1 and is fixed in version 2.30.0_1.