core/lib/Drupal/Core/Url.php             |  6 ++++++
 core/tests/Drupal/Tests/Core/UrlTest.php | 11 +++++++++++
 2 files changed, 17 insertions(+)

diff --git a/core/lib/Drupal/Core/Url.php b/core/lib/Drupal/Core/Url.php
index 6a8c17a..8c59abe 100644
--- a/core/lib/Drupal/Core/Url.php
+++ b/core/lib/Drupal/Core/Url.php
@@ -353,6 +353,9 @@ protected static function fromEntityUri(array $uri_parts, array $options, $uri)
    *
    * @return \Drupal\Core\Url
    *   A new Url object for a 'user-path:' URI.
+   *
+   * @throws \InvalidArgumentException
+   *   Thrown when the URI's path component doesn't have a leading slash.
    */
   protected static function fromUserPathUri(array $uri_parts, array $options) {
     // Both PathValidator::getUrlIfValidWithoutAccessCheck() and 'base:' URIs
@@ -366,6 +369,9 @@ protected static function fromUserPathUri(array $uri_parts, array $options) {
       $uri_parts['path'] = '<front>';
     }
     else {
+      if ($uri_parts['path'][0] !== '/') {
+        throw new \InvalidArgumentException(String::format('The user-path path component "@path" is invalid. Its path component must have a leading slash, e.g. user-path:/foo.', ['@path' => $uri_parts['path']]));
+      }
       // Remove the leading slash.
       $uri_parts['path'] = substr($uri_parts['path'], 1);
     }
diff --git a/core/tests/Drupal/Tests/Core/UrlTest.php b/core/tests/Drupal/Tests/Core/UrlTest.php
index 4096e3d..1c772f7 100644
--- a/core/tests/Drupal/Tests/Core/UrlTest.php
+++ b/core/tests/Drupal/Tests/Core/UrlTest.php
@@ -637,6 +637,17 @@ public function providerTestToUriStringForUserPath() {
   }
 
   /**
+   * Tests the fromUri() method with an invalid entity: URI.
+   *
+   * @covers ::fromUri
+   * @expectedException \InvalidArgumentException
+   * @expectedExceptionMessage The user-path path component "kittens" is invalid. Its path component must have a leading slash, e.g. user-path:/foo.
+   */
+  public function testInvalidUserPathUriPath() {
+    Url::fromUri('user-path:kittens');
+  }
+
+  /**
    * Tests the toUriString() method with route: URIs.
    *
    * @covers ::toUriString