The solution was to add an escape character:

criteriaBuilder.like(file.get("name"), "%" + filename + "%", '\\');

Otherwise, wildcards such as % or _ won't get treated as wildcards.