The & is a reserved character for URLs that divides parameters. cPanel fails to URL-encode its parameters, so this creates problems using HTTP to pass valid linux filenames to a url without proper encoding.

This is a cPanel bug.