If you'd use an url with a filename that contains an '%' the client should always encode it to '%25' which would get decoded correctly in this case.

In RFC1738 the '%' is an "Unsafe Character" and should always be encoded in URIs

The check could be extended to something like %([a-f0-9]{2}) but directories or files like %ears or %b1blabla would fail that check, too.