---
title: "Éclair 1.10.4: second security audit, six flaws fixed"
description: "Éclair 1.10.4 fixes the 6 flaws found by a second security audit, including a high one in the release tooling. What changes, what to do, the report."
url: "https://eclaircms.org/blog/eclair-1-10-4-second-security-audit"
lang: "en"
author: "Thierry Gustin"
published: "2026-11-04"
updated: "2026-11-10"
---

# Éclair 1.10.4: second security audit, six flaws fixed

> **Key takeaways** — Released on November 4, 2026, Éclair 1.10.4 fixes the six flaws found by a second audit of the 1.10.3 code: one high, in the tool that builds releases and never in an installed site, one medium linked to Google Drive and four low, plus six hardening items. This audit is a partial pass, and the report says so. One-click update from 1.10.0 onwards, after a backup.

Éclair 1.10.4, released on November 4, 2026, fixes the six flaws found by a second security audit: one high, but in the maintainer’s release tooling and never in your site, one medium linked to Google Drive and four low. None is critical. The full report, in English, is online: [read the security report (PDF, 18 pages)](https://eclaircms.org/assets/site/eclair-cms-security-report-2026-11.pdf).

## What’s new in Éclair 1.10.4?

| Item | What to remember |
| --- | --- |
| Audited code | The 1.10.3 code, reviewed with a more thorough method (*deep* profile) |
| Confirmed flaws | 6: 1 high (release tooling), 1 medium (Google Drive), 4 low |
| Leads to validate | 6 host-dependent leads, fixed in the code as a precaution |
| Fixes | 13, each with a test that checks the defect doesn’t come back |
| Checks | 964 automated checks, on the code and on the signed archive |
| Archive | 621 KB, signed update (Ed25519) verified before anything changes |
| What you need to do | Update after a backup, then reconnect Google Drive if asked |

Your public site doesn’t change by a single byte, and your content doesn’t move. The day before, 1.10.3 fixed the 15 flaws of the first audit: [read the post about Éclair 1.10.3](https://eclaircms.org/blog/eclair-1-10-3-security-audit).

## Why a second audit right after 1.10.3?

A security fix has to be checked. So the second audit went back over every flaw and every lead of the first one, on the changed code, with fresh agents. The result: the 1.10.3 fixes held.

It also looked further. The *deep* profile of [Cloudflare’s *security-audit* method](https://github.com/cloudflare/security-audit-skill) adds the moments in a site’s life: right after an update, after restoring a backup, during a rollback or a reinstall. Several of the new flaws come precisely from those moments.

Like the first one, this audit was done by reading the source code and testing it locally, in a sandbox locked down by the operating system, on dummy data, with no network access and without touching any live site. It used 54 agents; with the first audit and the fixes, that makes 148 agents in total.

## What did the second security audit find?

The second audit examined 13 distinct candidates. Six were confirmed:

- **One high, in the release tooling**: the command the maintainer uses to re-sign a release could sign an archive swapped in by someone without the key. It now signs only an archive already signed for that version. This defect doesn’t affect any installed site.
- **One medium, Google Drive**: a connection made before 1.10.3 didn’t record which administrator set it up. A deleted or demoted administrator could therefore have kept receiving backups. These connections are now removed.
- **Four low**: restoring a backup no longer revives sessions cut by **Log everyone out**; unpublishing clears the cache even if a later write fails; **Roll back to the previous version** keeps a `.htaccess` changed since the update; rebuilding the index no longer republishes deleted content, which comes back as a draft.

The six remaining leads depend on the host, the browser or a third-party service’s billing. They can’t be observed offline, so they’re fixed as a precaution, like one last candidate about reserved redirects that verification couldn’t settle. The report describes each problem and its fix, with no exploitation detail at all.

## Why is it called a partial pass?

Because it is one, and the report says so in black and white. This second audit was deliberately shortened to limit its cost:

- **6 areas** out of 71 were deferred and never explored, for example stored backup archives or the MCP connector’s quotas;
- **no final review** of the coverage was carried out;
- **the 1.10.4 fixes** are covered by tests, but haven’t been audited themselves yet.

So the report doesn’t claim that 1.10.3 or 1.10.4 was fully covered. It recommends resuming the audit on those areas, then auditing 1.10.4. The key point: no critical flaw in either audit, and every confirmed flaw is fixed.

## What should you do after updating to 1.10.4?

Most of the time, nothing. Only one case asks something of you: if you connected Google Drive before 1.10.3, the connection is removed, and the **Security** page tells you so.

1. Open **Security › Google Drive backups**.
2. Click **Connect Google Drive**, then enter the code shown at **google.com/device**.
3. Check your backup schedule, then click **Save**.

The backups already sent stay in your Drive. Other changes worth knowing:

- **AI images rejected** by the provider’s filter (FLUX, Ideogram) now count toward your monthly AI budget, like any billed image.
- **If `data/site.php` disappears**, the installer stays locked until you delete `data/install-window.php` via FTP. Reinstalling keeps your accounts, keys and content.
- **Your data files** and backup archives are created private from the start.

## How do you upgrade to Éclair 1.10.4?

From 1.10.0 or later, the update takes one click:

1. In **Security › Backup**, click **Download a backup**.
2. Open **Admin › Updates**.
3. Check “I have a recent backup of my site”, then click **Update to …**.

The update is signed and verified before the slightest change, with automatic rollback if something goes wrong. The version offered today includes all these fixes.

From 1.9 or earlier, go through FTP one last time: the archive is waiting on the [Download](https://eclaircms.org/en/download) page, and the [Updating, backing up, moving](https://eclaircms.org/en/documentation/updates) guide details each step. Every version is listed in the [changelog](https://eclaircms.org/en/changelog), and Éclair’s protections in [Éclair’s security](https://eclaircms.org/en/documentation/security).

## Where can you read the full security report?

The report covers both audits and versions 1.10.3 and 1.10.4. It’s **in English**, as a PDF, 18 pages long. You’ll find the method, the sandbox, each flaw with its fix, the protections found sound and the limits of the exercise.

[Download the security report (PDF in English, 18 pages)](https://eclaircms.org/assets/site/eclair-cms-security-report-2026-11.pdf)

A question about the report, or a doubt about your hosting? Write to me through the [contact page](https://eclaircms.org/en/contact).

## Frequently asked questions about Éclair 1.10.4

### Was my site exposed to the high flaw?

No. It affected the tool the maintainer uses to build and sign releases, never an installed site. Your updates are still signed and verified before the slightest change.

### Do I need to reconnect Google Drive?

Only if your connection dates from before 1.10.3. In that case, the Security page tells you: click Connect Google Drive and enter the code at google.com/device. Your older backups stay in your Drive.

### Did the second audit check everything?

No, and the report says so: it’s a partial pass. Six areas weren’t explored, and the 1.10.4 fixes haven’t been audited yet. Neither audit found a critical flaw.

### Why is the report in English?

It’s the language of Éclair’s official changelog and code. The report describes each problem and its fix, with no exploitation detail, and this post sums up the essentials.

### How much does the update to 1.10.4 cost?

Nothing: Éclair is still free, under the AGPL-3.0 license. The only budget change: AI images rejected by the provider now count toward your monthly budget.

[Download Éclair 2.3.0](https://eclaircms.org/en/download)

— Thierry Gustin, Créateur d’Éclair CMS, consultant SEO et formateur IA · November 10, 2026