On line 56 of files.php which reads
$filename = urldecode($_REQUEST['filename']);
if the file name contains a + character it is translated to a space character and the attachment is not available. The urldecode fumction translates + to spaces.
To correct the issue replace the line with
$filename = rawurldecode($_REQUEST['filename']);