Try looking at the 'find' command, rather than a script.
ie:
Code:
find /your/top/dir -type d -name 'CVS' -exec rm -rfi {} \;
should pull off what you need.
Instead of rm'ing them, you could also make them unaccessible to the user that your web server runs under. That way, the CVS directory is not accessible via a browser, but it's still there, so your CVS sandbox and web site directory are still in one place.