diff --git a/src/etc/inc/pfsense-utils.inc b/src/etc/inc/pfsense-utils.inc
index 526bef7265..c3f97eb88b 100644
--- a/src/etc/inc/pfsense-utils.inc
+++ b/src/etc/inc/pfsense-utils.inc
@@ -2616,10 +2616,12 @@ function process_alias_tgz($temp_filename) {
 		log_error(gettext("Alias archive is a .tar/tgz file which cannot be decompressed because utility is missing!"));
 		return false;
 	}
+	$temp_dir = "{$temp_filename}/aliasdata/";
+	mkdir($temp_dir);
 	rename("{$temp_filename}/aliases", "{$temp_filename}/aliases.tgz");
-	mwexec("/usr/bin/tar xzf {$temp_filename}/aliases.tgz -C {$temp_filename}/aliases/");
+	mwexec("/usr/bin/tar xzf {$temp_filename}/aliases.tgz -C {$temp_dir}");
 	unlink("{$temp_filename}/aliases.tgz");
-	$files_to_process = return_dir_as_array("{$temp_filename}/");
+	$files_to_process = return_dir_as_array($temp_dir);
 	/* foreach through all extracted files and build up aliases file */
 	$fd = @fopen("{$temp_filename}/aliases", "w");
 	if (!$fd) {
@@ -2627,19 +2629,29 @@ function process_alias_tgz($temp_filename) {
 		return false;
 	}
 	foreach ($files_to_process as $f2p) {
+		/* Entries in this array should not have a directory path,
+		 * but be safe and add the expected path to the basename. */
+		$f2p = $temp_dir . basename($f2p);
+		/* Do not process links or items which are not files */
+		if (is_link($f2p) ||
+			!is_file($f2p)) {
+			log_error(sprintf(gettext('The following entry from the archive is not a regular file: %1$s'), $f2p));
+			continue;
+		}
 		$tmpfd = @fopen($f2p, 'r');
 		if (!$tmpfd) {
 			log_error(sprintf(gettext('The following file could not be read %1$s from %2$s'), $f2p, $temp_filename));
 			continue;
 		}
-		while (($tmpbuf = fread($tmpfd, 65536)) !== FALSE) {
+		while ($tmpbuf = fgets($tmpfd)) {
 			fwrite($fd, $tmpbuf);
 		}
 		fclose($tmpfd);
-		unlink($f2p);
+		@unlink($f2p);
 	}
 	fclose($fd);
 	unset($tmpbuf);
+	@rmdir_recursive($tmp_dir);
 
 	return true;
 }