"device URL syntax" section of docs doesn't document how to say "no this really is a local file"
In our documentation the "device URL syntax" part of the invocation docs (https://www.qemu.org/docs/master/system/invocation.html#device-url-syntax) describes how you can pass options like '-cdrom' a URL, e.g. "-cdrom iscsi://192.0.2.1/iqn.2001-04.com.example/2".
This documentation is missing the information on how you should escape a local filename if it happens to be something that would otherwise be parsed as a protocol (and most things with a ':' in them seem to be treated as a protocol).
Testing, it seems to be the case that you can write "-cdrom file:foo:bar.iso" to access a local file "foo:bar.iso". Oddly, "file://foo:bar.iso" which you might have expected to work does not (it uses "//foo:bar.iso" as the filename). You can also avoid this by giving the filename with a path with a '/' in it, like "-cdrom ./foo:bar.iso".
We should expand the documentation to tell users how to avoid their filenames getting parsed as protocols.