diff --git a/src/wp-includes/class-http.php b/src/wp-includes/class-http.php
index c014004c05..206d406539 100644
--- a/src/wp-includes/class-http.php
+++ b/src/wp-includes/class-http.php
@@ -213,7 +213,7 @@ class WP_Http {
 		 * and pick its name using the basename of the $url.
 		 */
 		if ( $r['stream']  && empty( $r['filename'] ) ) {
-			$r['filename'] = wp_unique_filename( get_temp_dir(), basename( $url ) );
+			$r['filename'] = get_temp_dir() . wp_unique_filename( get_temp_dir(), basename( $url ) );
 		}
 
 		/*
diff --git a/tests/phpunit/tests/http/base.php b/tests/phpunit/tests/http/base.php
index e4af6b8744..f7b14806b8 100644
--- a/tests/phpunit/tests/http/base.php
+++ b/tests/phpunit/tests/http/base.php
@@ -188,12 +188,13 @@ abstract class WP_HTTP_UnitTestCase extends WP_UnitTestCase {
 		if ( ! is_wp_error( $res ) ) {
 			$filesize = filesize( $res['filename'] );
 			unlink( $res['filename'] );
-		}		
+		}
 
 		$this->assertFalse( is_wp_error( $res ) );
 		$this->assertEquals( '', $res['body'] ); // The body should be empty.
 		$this->assertEquals( $size, $res['headers']['content-length'] ); // Check the headers are returned (and the size is the same..)
 		$this->assertEquals( $size, $filesize ); // Check that the file is written to disk correctly without any extra characters
+		$this->assertStringStartsWith( get_temp_dir(), $res['filename'] ); // Check it's saving within the temp dir
 	}
 
 	/**