Bracket Expansion!

Gema, 17 characters

[#]?=@repeat{?;#}

Sample run:

bash-4.4$ gema '[#]?=@repeat{?;#}' <<< '[three[two[one]1]2]3'
threetwoonetwoonethreetwoonetwoonethreetwoonetwoone

+`\[([^][]*)](.)
$2*$1

Try it online! This is practically a builtin in Retina 1. Edit: Saved 1 byte thanks to @Kobi. 47 45 bytes in Retina 0.8.2:

].
]$&$*¶
{+`\[([^][]*)]¶
$1[$1]
\[([^][]*)]

Try it online!

fst.(""%)
infix 4%
s%']':d:r=(['1'..d]>>s,r)
s%'[':r|(t,q)<-""%r=s++t%q
s%x:r=s++[x]%r
s%e=(s,e)

Try it online! Instead of using regular expression like most of the other answers, this implements a recursive parser.

-5 bytes thanks to BMO!