diff --git a/composer.lock b/composer.lock
index b3930c4b582c79f54ad386fd72eebc81f5890a99..d64666b2bdff3f344cb9fff12af38263c61ba11b 100644
--- a/composer.lock
+++ b/composer.lock
@@ -653,7 +653,7 @@
             "dist": {
                 "type": "path",
                 "url": "core",
-                "reference": "fccc4c0fffd3f4d3aa239dff24ace99b9c52074e"
+                "reference": "5e617499e0c484e70f24bdf4334359cf37c95f9a"
             },
             "require": {
                 "asm89/stack-cors": "^1.1",
@@ -676,7 +676,7 @@
                 "ext-xml": "*",
                 "guzzlehttp/guzzle": "^6.3",
                 "masterminds/html5": "^2.1",
-                "pear/archive_tar": "^1.4.8",
+                "pear/archive_tar": "^1.4.9",
                 "php": ">=7.2.3",
                 "psr/log": "^1.0",
                 "stack/builder": "^1.0",
@@ -1252,16 +1252,16 @@
         },
         {
             "name": "pear/archive_tar",
-            "version": "1.4.8",
+            "version": "1.4.9",
             "source": {
                 "type": "git",
                 "url": "https://github.com/pear/Archive_Tar.git",
-                "reference": "442bdffb7edb84c898cfd94f7ac8500e49d5bbb5"
+                "reference": "c5b00053770e1d72128252c62c2c1a12c26639f0"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/pear/Archive_Tar/zipball/442bdffb7edb84c898cfd94f7ac8500e49d5bbb5",
-                "reference": "442bdffb7edb84c898cfd94f7ac8500e49d5bbb5",
+                "url": "https://api.github.com/repos/pear/Archive_Tar/zipball/c5b00053770e1d72128252c62c2c1a12c26639f0",
+                "reference": "c5b00053770e1d72128252c62c2c1a12c26639f0",
                 "shasum": ""
             },
             "require": {
@@ -1314,7 +1314,7 @@
                 "archive",
                 "tar"
             ],
-            "time": "2019-10-21T13:31:24+00:00"
+            "time": "2019-12-04T10:17:28+00:00"
         },
         {
             "name": "pear/console_getopt",
diff --git a/composer/Metapackage/CoreRecommended/composer.json b/composer/Metapackage/CoreRecommended/composer.json
index 9bfaa5043f77177cc4cfd2ffcd49857c09a2bba4..eac9e2a75b155a68f9fa9e579338efa8f976e25b 100644
--- a/composer/Metapackage/CoreRecommended/composer.json
+++ b/composer/Metapackage/CoreRecommended/composer.json
@@ -22,7 +22,7 @@
         "guzzlehttp/promises": "v1.3.1",
         "guzzlehttp/psr7": "1.6.1",
         "masterminds/html5": "2.7.0",
-        "pear/archive_tar": "1.4.8",
+        "pear/archive_tar": "1.4.9",
         "pear/console_getopt": "v1.4.2",
         "pear/pear-core-minimal": "v1.10.9",
         "pear/pear_exception": "v1.0.0",
diff --git a/core/composer.json b/core/composer.json
index 2d4c832d44032e62528fd9efe18d63e0c704f77b..fbcdee3e6adf6f66349e88168b80226b6dd483b3 100644
--- a/core/composer.json
+++ b/core/composer.json
@@ -45,7 +45,7 @@
         "zendframework/zend-diactoros": "^1.8",
         "composer/semver": "^1.0",
         "asm89/stack-cors": "^1.1",
-        "pear/archive_tar": "^1.4.8",
+        "pear/archive_tar": "^1.4.9",
         "psr/log": "^1.0"
     },
     "conflict": {
diff --git a/core/lib/Drupal/Core/Archiver/Tar.php b/core/lib/Drupal/Core/Archiver/Tar.php
index 3b33dddfe4d3ef1643004a59840e99a1508c05a5..ecc62abd8f8ad22666d15c27ba4d7894524db848 100644
--- a/core/lib/Drupal/Core/Archiver/Tar.php
+++ b/core/lib/Drupal/Core/Archiver/Tar.php
@@ -54,10 +54,10 @@ public function remove($file_path) {
    */
   public function extract($path, array $files = []) {
     if ($files) {
-      $this->tar->extractList($files, $path);
+      $this->tar->extractList($files, $path, '', FALSE, FALSE);
     }
     else {
-      $this->tar->extract($path);
+      $this->tar->extract($path, FALSE, FALSE);
     }
 
     return $this;
diff --git a/core/modules/config/src/Form/ConfigImportForm.php b/core/modules/config/src/Form/ConfigImportForm.php
index 9d0d1e9da709c4290639c81adfe81c46556b6f59..74c73b8d999ac5d99e442d9bac367ed8baac6e86 100644
--- a/core/modules/config/src/Form/ConfigImportForm.php
+++ b/core/modules/config/src/Form/ConfigImportForm.php
@@ -123,7 +123,7 @@ public function submitForm(array &$form, FormStateInterface $form_state) {
         foreach ($archiver->listContent() as $file) {
           $files[] = $file['filename'];
         }
-        $archiver->extractList($files, $this->settings->get('config_sync_directory'));
+        $archiver->extractList($files, $this->settings->get('config_sync_directory'), '', FALSE, FALSE);
         $this->messenger()->addStatus($this->t('Your configuration files were successfully uploaded and are ready for import.'));
         $form_state->setRedirect('config.sync');
       }