There is a customer that has placed their WSDL files under
WEB-INF/classes/wsdl rather than just WEB-INF/wsdl. They then put
their WSDL under a subdirectory of that folder, say "thewsdl". Then
that WSDL references other schemas in other subdirectories at the same
level as the WSDL's subdirectory. Like this:

WEB-INF/
classes/
wsdl/
thewsdl/
the-actual-wsdl.wsdl
schemas/
some-schema.xsd

When this gets deployed, all the imported schemas fall outside the
deployment's data/wsdl folder when they are written to the filesystem.
Like this:

standalone/
data/
wsdl/
myDeployment.war/
<wsdl would go here>
schemas/
some-schema.xsd

This can cause weird concurrency issues if multiple deployment
processor threads happen to be processing separate webservices where
each have WSDLs that happen to import schemas with the same schemaLocation
attribute. In the above scenario, the schemaLocation would include a
".." since the WSDL would be in its own subfolder.

The code that writes these files to disk is here

Line 224:
https://anonsvn.jboss.org/repos/jbossws/common/tags/jbossws-common-2.3.1.Final/src/main/java/org/jboss/ws/common/utils/AbstractWSDLFilePublisher.java

Line 190:
https://anonsvn.jboss.org/repos/jbossws/stack/cxf/tags/jbossws-cxf-4.3.3.Final/modules/server/src/main/java/org/jboss/wsf/stack/cxf/deployment/WSDLFilePublisher.java

The problem is that WSDLFilePublisher.getPublishLocation() cuts off
subfolders that the WSDL is under in this particular scenario, so when
the schemaLocation that has ".." in it is appended to the WSDL path,
it will write the schema outside the deployment's data/wsdl/ folder.