The _list file get function in lib/Majordomo.pm in Majordomo 2 before 20110131 has a directory traversal vulnerability that allows remote attackers to read arbitrary files using dot dot(..) sequences in the help command, as shown by a forged email and cgi-bin/mj wwwusr in the web interface.
We recommend you update to snapshot 20110204 or later.