When validating a site with CFC enabled, the following error is reported:
& did not start a character reference. (& probably should have been escaped as &.)
Looking at the HTML, the URL in the IMG SRC is using raw characters when they should be escaped.