A vulnerability in setuptools on Windows allows an attacker to craft a wheel file with a specially crafted .dist-info/namespace_packages.txt file. This can cause setuptools' legacy wheel installation to create an __init__.py file outside the intended installation directory, at a filesystem path influenced by the attacker. The created file contains fixed content and is created with the permissions of the installing process. The vulnerability affects setuptools versions from 2.15.3 up to but not including 2.18.1_2 and requires the target parent directory to already exist.