An issue exists where filenames for uploads are predictable. By recovering the state of the `Math.random` generator, an attacker who obtains five consecutive gfycat-style filenames can reconstruct the random state. This allows the prediction of previous and future filenames until the instance restarts, which may expose private uploads.