=== modified file 'Mailman/Defaults.py.in'
--- a/Mailman/Defaults.py.in	2015-02-13 18:41:28 +0000
+++ b/Mailman/Defaults.py.in	2015-03-27 18:10:39 +0000
@@ -138,7 +138,7 @@
 
 # A Python regular expression character class which defines the characters
 # allowed in list names.  Lists cannot be created with names containing any
-# character that doesn't match this class.
+# character that doesn't match this class.  Do not include '/' in this list.
 ACCEPTABLE_LISTNAME_CHARACTERS = '[-+_.=a-z0-9]'
 
 

=== modified file 'Mailman/Utils.py'
--- a/Mailman/Utils.py	2015-01-23 23:50:47 +0000
+++ b/Mailman/Utils.py	2015-03-27 18:14:06 +0000
@@ -100,6 +100,12 @@
     #
     # The former two are for 2.1alpha3 and beyond, while the latter two are
     # for all earlier versions.
+    #
+    # But first ensure the list name doesn't contain a path traversal
+    # attack.
+    if len(re.sub(mm_cfg.ACCEPTABLE_LISTNAME_CHARACTERS, '', listname)) > 0:
+        syslog('mischief', 'Hostile listname: %s', listname)
+        return False
     basepath = Site.get_listpath(listname)
     for ext in ('.pck', '.pck.last', '.db', '.db.last'):
         dbfile = os.path.join(basepath, 'config' + ext)