Comment 0 for bug 307291

Script names aren't checked for "/"-characters, so that virtual users can edit other scripts by using a script name like "../../other_user/sieve/script".

See here for more details and a patch:

http://dovecot.org/list/dovecot/2008-November/035259.html