The vulnerability stems from rclone's RC API error handling. When a panic occurs, the API returns a full Go stack trace. This leak can reveal internal file paths, module names, goroutine states, and memory addresses, exposing sensitive implementation details. The flaw is classified as a CWE‑209 Information Exposure via Application Data.

Affecting installations of rclone versions earlier than 1.75.0. The vulnerability applies to all platforms where the RC API is enabled. Version 1.75.0 and later rectify the issue by removing stack traces from RC API responses.

The CVSS score of 5.1 indicates a moderate severity vulnerability, and the EPSS score is not available, meaning the likelihood of exploitation cannot be precisely quantified. The vulnerability is not listed in CISA KEV. The attack most likely involves sending a crafted request to the RC API endpoint to trigger a panic, a feasible action for any user with network access to the API. As a result, the flaw could allow an attacker to gain internal system information through a simple API call.