Is there a way to execute commands using directory traversal attacks?

For instance, I access a server's etc/passwd file like this

http://server.com/..%01/..%01/..%01//etc/passwd

Is there a way to run a command instead? Like...

http://server.com/..%01/..%01/..%01//ls

..... and get an output?

EDIT: To be clear here, I've found the vuln in our company's server. I'm looking to raise the risk level (or bonus points for me) by proving that it may give an attacker complete access to the system