jackalope/jackalope — comment on commit 29b02742c0060a049c6cbee9efc418270e9c57d1
File: src/Jackalope/Transport/Jackrabbit/Client.php line 627
By dbu:

you should encode and validate the concatenated thing, not just $versionPath. imagine somebody putting something invalid into $versionName...