Steps to reproduce the issue

I'm not sure if this is the expected behavior. If I'm wrong, close this.

Pack any file into a ZIP archive, whatever. For example, a program with an exe file. Go to System - Joomla Update, select the manual installation item (below), select the archive and install. Joomla will be "updated" with a message that it has been successfully updated to "such and such version". All contents of the archive go to the root of the site.