diff -u b/core/lib/Drupal/Core/StreamWrapper/LocalStream.php b/core/lib/Drupal/Core/StreamWrapper/LocalStream.php
--- b/core/lib/Drupal/Core/StreamWrapper/LocalStream.php
+++ b/core/lib/Drupal/Core/StreamWrapper/LocalStream.php
@@ -155,8 +155,8 @@
     // Check whether the target dir exists within the files repository.
     $subdirectory = strpos($target_dir, $repository . DIRECTORY_SEPARATOR) === 0;
     if ($traversal && !$subdirectory) {
-        // If the target path contains directory-traversal parts such as '/..' and
-        // does not resolve to a subdirectory of the repository, then return FALSE
+        // If the target path contains directory-traversal parts such as '/..'
+        // and does not resolve to a subdirectory of the repository, then return FALSE
         // to avoid a possible exploit.
       return FALSE;
     }