> without using a different vulnerability to invoke the JRE on the file

Funnily enough this is exactly how real attacks tend to work https://googleprojectzero.blogspot.com/2019/08/a-very-deep-d...