There are a number of places in the VFS code that are doing

java.util.File.toURL()

which doesn't escape the URL properly. These should at least be doing

File.toURI().toURL()

to get the correctly escaped URL.

e.g. in FileSystemContext

protected DelegatingHandler mountZipFS(VirtualFileHandler parent, String name, File file) throws IOException, URISyntaxException
{
DelegatingHandler delegator = new DelegatingHandler(this, parent, name);
URL fileUrl = file.toURL(); // HERE!!!!!!!