Hello, You can validate also the file names using Schematron.
That's why you'll typically find the contents of an EPUB 2 book in an /OPS or /OEBPS subfolder and EPUB 3s in /EPUB.
So long as the location of the opf file is correctly identified, and all the resources listed in the manifest are correctly referenced relative to the position of that file in the container, the structure should not be an issue.
It's impossible to know what error you're encountering, except that it's caused some exception the web service doesn't appear able to handle.
In a case like this, the best thing to do is download epubcheck and run it locally to see what it has to say.
If you do have one, then you are protected against people crafting images to perform this type of attack. We know that some people don’t store the content types on their models, but still need a way to be valid.