A vulnerability in setuptools on Windows allows a crafted wheel's namespace_packages.txt to cause creation of an __init__.py file outside the intended installation directory. This occurs during legacy wheel installation when an absolute Windows path is supplied in the namespace_packages.txt file. The created file contains fixed content and is placed with the permissions of the installing process. The parent directory must already exist for this to succeed.