Arbitrary file deletion vulnerability

I found a vulnerability in the Apache zeppelin (Unauthorized Level Vulnerability) project.

By accessing

/api/interpreter/setting/..%2Flogs 

you can delete the logs folder in the directory where the current project is located, if it is changed to

/api/interpreter/setting/..%2F..%2Fzeppelin 

, then you can delete the entire zeppelin application directory, including all configuration files, zeppelin main program files, etc.