diff --git a/core/modules/filter/filter.module b/core/modules/filter/filter.module
index f52614a..56cef08 100644
--- a/core/modules/filter/filter.module
+++ b/core/modules/filter/filter.module
@@ -767,6 +767,10 @@ function _filter_html_image_secure_process($text) {
   $base_path = base_path();
   $base_path_length = Unicode::strlen($base_path);
 
+  // Find the private path.
+  $private_path = '/system/files/';
+  $private_path_length = Unicode::strlen($private_path);
+
   // Find the directory on the server where index.php resides.
   $local_dir = \Drupal::root() . '/';
 
@@ -781,7 +785,16 @@ function _filter_html_image_secure_process($text) {
     // Verify that $src starts with $base_path.
     // This also ensures that external images cannot be referenced.
     $src = $image->getAttribute('src');
-    if (Unicode::substr($src, 0, $base_path_length) === $base_path) {
+    if (Unicode::substr($src, 0, $private_path_length) === $private_path) {
+      $private_image_path = Unicode::substr($src, $private_path_length);
+      $private_image_path = 'private://' . $private_image_path;
+      $image = \Drupal::service('image.factory')->get($private_image_path);
+      if ($image->getFileSize()) {
+        // The image has the right path. Erroneous images are dealt with below.
+        continue;
+      }
+    }
+    elseif (Unicode::substr($src, 0, $base_path_length) === $base_path) {
       // Remove the $base_path to get the path relative to the Drupal root.
       // Ensure the path refers to an actual image by prefixing the image source
       // with the Drupal root and running getimagesize() on it.