CVE-2025-27136: LocalS3 XML External Entity Injection in Bucket Creation

LocalS3 is a mock Amazon S3 service for local development and testing. The bucket creation endpoint parses a CreateBucketConfiguration XML document, and its parser resolves external entities.

An attacker declares an entity pointing at an internal URL inside the LocationConstraint element. The server fetches that URL while parsing and stores the response in the bucket configuration, where a follow-up location query reads it back. Anyone who can send HTTP requests to LocalS3 can use it to reach internal services. LocalS3 1.21 fixes the issue.