diff --git modules/system/system.admin.inc modules/system/system.admin.inc
index f206055..659ef96 100644
--- modules/system/system.admin.inc
+++ modules/system/system.admin.inc
@@ -1742,6 +1742,10 @@ function system_clear_page_cache_submit($form, &$form_state) {
  * @see system_settings_form()
  */
 function system_file_system_settings() {
+  $form = array(
+    '#after_build' => array('system_check_secure_directory'),
+  );
+
   $form['file_public_path'] = array(
     '#type' => 'textfield',
     '#title' => t('Public file system path'),
diff --git modules/system/system.module modules/system/system.module
index 697c394..5bc9402 100644
--- modules/system/system.module
+++ modules/system/system.module
@@ -2128,6 +2128,32 @@ function system_check_directory($form_element) {
 }
 
 /**
+ * Checks that the private and temporary directories do not resolve to the same
+ * directory as the public directory.
+ *
+ * This function is called from the system_settings form to check all core
+ * file directories (file_public_path, file_private_path, file_temporary_path).
+ *
+ * @param $form_element
+ *   The form element containing the name of the directory to check.
+ */
+function system_check_secure_directory($form_element) {
+  $resolved_public_path = realpath($form_element['file_public_path']['#value']);
+  $resolved_private_path = realpath($form_element['file_private_path']['#value']);
+  $resolved_temporary_path = realpath($form_element['file_temporary_path']['#value']);
+
+  if ($resolved_public_path == $resolved_private_path) {
+    form_set_error('file_private_path', t('The private file system path must not be the same as the public file system path.'));
+  }
+
+  if ($resolved_public_path == $resolved_temporary_path) {
+    form_set_error('file_temporary_path', t('The tempoary directory must not be the same as the public file system path.'));
+  }
+
+  return $form_element;
+}
+
+/**
  * Retrieves the current status of an array of files in the system table.
  *
  * @param $files