[First of all: My real CMSMS-version is 1.11.4 (updated from a clean install of
1.11.3), but that version is not available (yet) in the dropdowns.]

My CMSMS is installed in http://HOST/cms/ and I have NOT set $config['root_url']
in config.php, so the value is automatically set. I checked the "System
Information"-page: the value of root_url is correct.

Now my problem:
I am using the module Cataloger to add images to pages. Cataloger uses a central
class (Cataloger.Image.php) to redirect to the real images. So all image-links
look like this:
http://HOST/cms/modules/Cataloger/Cataloger.Image.php?i=IMAGE.jpg&ac=12345
The problem ist, that this link redirects to (causing 404s):
http://HOST/cms/modules/Cataloger/uploads/images/catalog/IMAGE.jpg?ac=12345
When in fact it should redirect to:
http://HOST/cms/uploads/images/catalog/IMAGE.jpg?ac=12345

I debugged a little and the problem seems to be in the file class.cms_config.php
in the method offsetGet(), where on line 239 it says:
$parts = parse_url($_SERVER['PHP_SELF']);
So, $_SERVER['PHP_SELF'] is used to build root_url. This normally works when
ROOT_URL/index.php is called. But I think it fails here, because
ROOT_URL/modules/Cataloger/Cataloger.Image.php is called instead and so the
returned value of root_url is "ROOT_URL/modules/Cataloger".
I was able to workaround this bug by manually setting root_url to
"http://HOST/cms" in my config.php, but as I understand, this should not be
necessary as of CMSMS 1.11.