Éclair 1.10.4: second security audit, six flaws fixed
By Thierry Gustin
Published
Updated
5 min read
Contents
- What’s new in Éclair 1.10.4?
- Why a second audit right after 1.10.3?
- What did the second security audit find?
- Why is it called a partial pass?
- What should you do after updating to 1.10.4?
- How do you upgrade to Éclair 1.10.4?
- Where can you read the full security report?
- Frequently asked questions about Éclair 1.10.4
Éclair 1.10.4, released on November 4, 2026, fixes the six flaws found by a second security audit: one high, but in the maintainer’s release tooling and never in your site, one medium linked to Google Drive and four low. None is critical. The full report, in English, is online: read the security report (PDF, 18 pages).
What’s new in Éclair 1.10.4?
| Item | What to remember |
|---|---|
| Audited code | The 1.10.3 code, reviewed with a more thorough method (deep profile) |
| Confirmed flaws | 6: 1 high (release tooling), 1 medium (Google Drive), 4 low |
| Leads to validate | 6 host-dependent leads, fixed in the code as a precaution |
| Fixes | 13, each with a test that checks the defect doesn’t come back |
| Checks | 964 automated checks, on the code and on the signed archive |
| Archive | 621 KB, signed update (Ed25519) verified before anything changes |
| What you need to do | Update after a backup, then reconnect Google Drive if asked |
Your public site doesn’t change by a single byte, and your content doesn’t move. The day before, 1.10.3 fixed the 15 flaws of the first audit: read the post about Éclair 1.10.3.
Why a second audit right after 1.10.3?
A security fix has to be checked. So the second audit went back over every flaw and every lead of the first one, on the changed code, with fresh agents. The result: the 1.10.3 fixes held.
It also looked further. The deep profile of Cloudflare’s security-audit method adds the moments in a site’s life: right after an update, after restoring a backup, during a rollback or a reinstall. Several of the new flaws come precisely from those moments.
Like the first one, this audit was done by reading the source code and testing it locally, in a sandbox locked down by the operating system, on dummy data, with no network access and without touching any live site. It used 54 agents; with the first audit and the fixes, that makes 148 agents in total.
What did the second security audit find?
The second audit examined 13 distinct candidates. Six were confirmed:
- One high, in the release tooling: the command the maintainer uses to re-sign a release could sign an archive swapped in by someone without the key. It now signs only an archive already signed for that version. This defect doesn’t affect any installed site.
- One medium, Google Drive: a connection made before 1.10.3 didn’t record which administrator set it up. A deleted or demoted administrator could therefore have kept receiving backups. These connections are now removed.
- Four low: restoring a backup no longer revives sessions cut by Log everyone out; unpublishing clears the cache even if a later write fails; Roll back to the previous version keeps a
.htaccesschanged since the update; rebuilding the index no longer republishes deleted content, which comes back as a draft.
The six remaining leads depend on the host, the browser or a third-party service’s billing. They can’t be observed offline, so they’re fixed as a precaution, like one last candidate about reserved redirects that verification couldn’t settle. The report describes each problem and its fix, with no exploitation detail at all.
Why is it called a partial pass?
Because it is one, and the report says so in black and white. This second audit was deliberately shortened to limit its cost:
- 6 areas out of 71 were deferred and never explored, for example stored backup archives or the MCP connector’s quotas;
- no final review of the coverage was carried out;
- the 1.10.4 fixes are covered by tests, but haven’t been audited themselves yet.
So the report doesn’t claim that 1.10.3 or 1.10.4 was fully covered. It recommends resuming the audit on those areas, then auditing 1.10.4. The key point: no critical flaw in either audit, and every confirmed flaw is fixed.
What should you do after updating to 1.10.4?
Most of the time, nothing. Only one case asks something of you: if you connected Google Drive before 1.10.3, the connection is removed, and the Security page tells you so.
- Open Security › Google Drive backups.
- Click Connect Google Drive, then enter the code shown at google.com/device.
- Check your backup schedule, then click Save.
The backups already sent stay in your Drive. Other changes worth knowing:
- AI images rejected by the provider’s filter (FLUX, Ideogram) now count toward your monthly AI budget, like any billed image.
- If
data/site.phpdisappears, the installer stays locked until you deletedata/install-window.phpvia FTP. Reinstalling keeps your accounts, keys and content. - Your data files and backup archives are created private from the start.
How do you upgrade to Éclair 1.10.4?
From 1.10.0 or later, the update takes one click:
- In Security › Backup, click Download a backup.
- Open Admin › Updates.
- Check “I have a recent backup of my site”, then click Update to ….
The update is signed and verified before the slightest change, with automatic rollback if something goes wrong. The version offered today includes all these fixes.
From 1.9 or earlier, go through FTP one last time: the archive is waiting on the Download page, and the Updating, backing up, moving guide details each step. Every version is listed in the changelog, and Éclair’s protections in Éclair’s security.
Where can you read the full security report?
The report covers both audits and versions 1.10.3 and 1.10.4. It’s in English, as a PDF, 18 pages long. You’ll find the method, the sandbox, each flaw with its fix, the protections found sound and the limits of the exercise.
Download the security report (PDF in English, 18 pages)
A question about the report, or a doubt about your hosting? Write to me through the contact page.
Frequently asked questions about Éclair 1.10.4
Was my site exposed to the high flaw?
No. It affected the tool the maintainer uses to build and sign releases, never an installed site. Your updates are still signed and verified before the slightest change.
Do I need to reconnect Google Drive?
Only if your connection dates from before 1.10.3. In that case, the Security page tells you: click Connect Google Drive and enter the code at google.com/device. Your older backups stay in your Drive.
Did the second audit check everything?
No, and the report says so: it’s a partial pass. Six areas weren’t explored, and the 1.10.4 fixes haven’t been audited yet. Neither audit found a critical flaw.
Why is the report in English?
It’s the language of Éclair’s official changelog and code. The report describes each problem and its fix, with no exploitation detail, and this post sums up the essentials.
How much does the update to 1.10.4 cost?
Nothing: Éclair is still free, under the AGPL-3.0 license. The only budget change: AI images rejected by the provider now count toward your monthly budget.
Read next
Migrate from WordPress to Éclair CMS without losing a URL
Migrate from WordPress to Éclair CMS with Eclair Export: content, images, SEO, menus and redirects carried over, a dry run, then a report for your client.
Éclair 2.3 and Eclair Export 1.1: migrating from WordPress made easy
Éclair 2.3 and Eclair Export 1.1 move a WordPress site in a single transfer: one key, one click, no download and no FTP. Diagrams and a step-by-step guide.
Create a website from A to Z with the Éclair CMS AI Agent
The complete guide to building a pro website with the Éclair CMS AI Agent: each step, the frictions removed, the screenshots and the download link.