From the spec:

Content locations are represented as Matrix Content (MXC) URIs. They look like:

mxc://<server-name>/<media-id>

<server-name> : The name of the homeserver where this content originated, e.g. matrix.org
<media-id> : An opaque ID which identifies the content.

However, it is not specified anywhere (as far as I can tell) what the valid character range is for these opaque media-ids. In particular, it doesn't specify whether the media-id may contain slashes - a detail that's quite semantically important for a lot of HTTP request routing implementations, which often treat a "URL parameter" as a string of any characters other than a slash, eg. as in /media/:id where /media/foo/bar would not match.