diff --git a/core/lib/Drupal/Component/Transliteration/PhpTransliteration.php b/core/lib/Drupal/Component/Transliteration/PhpTransliteration.php
index ab09ceb..efbedc3 100644
--- a/core/lib/Drupal/Component/Transliteration/PhpTransliteration.php
+++ b/core/lib/Drupal/Component/Transliteration/PhpTransliteration.php
@@ -243,7 +243,10 @@ protected function lookupReplacement($code, $unknown_character = '?') {
   protected function readLanguageOverrides($langcode) {
     // Figure out the file name to use by sanitizing the language code,
     // just in case.
-    $file = $this->dataDirectory . '/' . preg_replace('/[^a-zA-Z\-]/', '', $langcode) . '.php';
+    if (strpbrk($langcode, './\\')) {
+      throw new \InvalidArgumentException('Invalid langcode');
+    }
+    $file = "$this->dataDirectory/$langcode.php";
 
     // Read in this file, which should set up a variable called $overrides,
     // which will be local to this function.
diff --git a/core/tests/Drupal/Tests/Component/Transliteration/PhpTransliterationTest.php b/core/tests/Drupal/Tests/Component/Transliteration/PhpTransliterationTest.php
index de7f428..1707f86 100644
--- a/core/tests/Drupal/Tests/Component/Transliteration/PhpTransliterationTest.php
+++ b/core/tests/Drupal/Tests/Component/Transliteration/PhpTransliterationTest.php
@@ -10,7 +10,6 @@
 use Drupal\Component\Transliteration\PhpTransliteration;
 use Drupal\Component\Utility\Random;
 use Drupal\Tests\UnitTestCase;
-use org\bovigo\vfs\vfsStream;
 
 /**
  * Tests Transliteration component functionality.
@@ -173,20 +172,10 @@ public function testTransliterationWithMaxLength() {
    * Tests inclusion is safe.
    *
    * @covers ::readLanguageOverrides
+   * @expectedException \InvalidArgumentException
+   * @expectedExceptionMessage Invalid langcode
    */
   public function testSafeInclude() {
-    // The overrides in the transliteration data directory transliterates 0x82
-    // into "safe" but the overrides one directory higher transliterates the
-    // same character into "security hole". So by using "../index" as the
-    // language code we can test the ../ is stripped from the langcode.
-    vfsStream::setup('transliteration', NULL, [
-      'index.php' => '<?php $overrides = ["../index" => [0x82 => "security hole"]];',
-      'dir' => [
-        'index.php' => '<?php $overrides = ["../index" => [0x82 => "safe"]];',
-      ],
-    ]);
-    $transliteration = new PhpTransliteration(vfsStream::url('transliteration/dir'));
-    $transliterated = $transliteration->transliterate(chr(0xC2) . chr(0x82), '../index');
-    $this->assertSame($transliterated, 'safe');
+    (new PhpTransliteration(sys_get_temp_dir()))->transliterate(chr(0xC2) . chr(0x82), '../index');
   }
 }