diff --git a/Controller/ApiController.php b/Controller/ApiController.php
index 3af3682..06fcdbb 100755
--- a/Controller/ApiController.php
+++ b/Controller/ApiController.php
@@ -367,7 +367,7 @@ final class ApiController extends Controller
      */
     public static function createMediaPath(string $basePath = '/Modules/Media/Files') : string
     {
-        $rndPath = \str_pad(\dechex(\mt_rand(0, 4294967295)), 8, '0', \STR_PAD_LEFT);
+        $rndPath = \bin2hex(\random_bytes(4));
         return $basePath . '/_' . $rndPath[0] . $rndPath[1] . $rndPath[2] . $rndPath[3] . '/_' . $rndPath[4] . $rndPath[5] . $rndPath[6] . $rndPath[7];
     }
 
diff --git a/Models/UploadFile.php b/Models/UploadFile.php
index 960f8fb..c48a1e8 100755
--- a/Models/UploadFile.php
+++ b/Models/UploadFile.php
@@ -245,9 +245,8 @@ class UploadFile
      */
     private function createFileName(string $path, string $tempName, string $extension) : string
     {
-        $rnd      = '';
-        $limit    = -1;
-        $fileName = '';
+        $rnd   = '';
+        $limit = -1;
 
         $nameWithoutExtension = empty($tempName)
             ? ''
@@ -256,19 +255,23 @@ class UploadFile
                 : \substr($tempName, 0, -\strlen($extension) - 1)
             );
 
-        do {
+        $fileName = $tempName;
+
+        while (\is_file($path . '/' . $fileName)) {
+            if ($limit >= self::PATH_GENERATION_LIMIT) {
+                throw new \Exception('No file path could be found. Potential attack!');
+            }
+
             ++$limit;
             $tempName = empty($nameWithoutExtension)
                 ? \sha1($tempName . $rnd)
-                : $nameWithoutExtension . (empty($rnd) ? '' : '_' . $rnd);
+                : $nameWithoutExtension . ($limit === 1 ? '' : '_' . $rnd);
 
-            $tempName .= !empty($extension) ? '.' . $extension : '';
-            $fileName = $tempName;
-            $rnd      = (string) \mt_rand();
-        } while (\is_file($path . '/' . $fileName) && $limit < self::PATH_GENERATION_LIMIT);
+            $fileName = empty($extension)
+                ? $tempName
+                : $tempName . '.' . $extension;
 
-        if ($limit >= self::PATH_GENERATION_LIMIT) {
-            throw new \Exception('No file path could be found. Potential attack!');
+            $rnd = \bin2hex(\random_bytes(3));
         }
 
         return $fileName;