Deploying and maintaining an enterprise-grade customer relationship management system requires more than just extracting source code onto a web server. More than 85% of critical Vtiger CRM failures—ranging from White Screen of Death (WSOD) errors, truncated module layouts, failed PDF quote generations, and broken cron workflows—are caused entirely by miscalibrated server limits, strict database modes, and unpatched PHP execution engines.
Whether you are provisioning a brand-new instance of Vtiger CRM 8.x, maintaining an established Vtiger 7.4 production instance, or troubleshooting third-party extension installations, having exact server settings is non-negotiable. This comprehensive technical guide details the definitive system requirements, version-by-version PHP compatibility, mandatory php.ini directives, MySQL strict mode workarounds, POSIX file permissions, background cron scheduling, and essential security patches.
Need assistance downloading verified source files or walking through an end-to-end installation? Explore our companion cornerstone guides: How to Download Vtiger CRM (Free & Open Source Guide) and How to Install Vtiger CRM (Windows & Linux Step-by-Step).
CVE-2026-109618 & CVE-2026-109619 Remote Code Execution
High-severity vulnerabilities (CVE-2026-109618 and CVE-2026-109619) allow unauthenticated remote attackers to execute arbitrary code on servers running vulnerable PHP runtimes. Official security fixes require updating immediately to PHP 8.2.35 or later in the 8.2 branch or PHP 8.3.36 or later in the 8.3 branch.
Impact on Legacy Vtiger Instances: PHP 8.1, PHP 7.4, and older runtimes have reached official End-of-Life (EOL) and do not receive upstream PHP security patches. If your Vtiger deployment relies on older PHP versions, we strongly recommend migrating to a modern, supported Vtiger 8.x branch. Until your upgrade is complete, isolate your server behind a Web Application Firewall (WAF), enforce IP allowlisting, or consult with CRMPUNCH Vtiger Security Services for backported security patches.
01. Recommended Server Environment Overview
For new enterprise installations and actively maintained Vtiger systems, align your infrastructure with the following verified production standard:
NO_ENGINE_SUBSTITUTION) and UTF-8 encoding.02. PHP Version Compatibility by Vtiger CRM Release
One of the most frequent errors in Vtiger server administration is running a PHP version mismatched with the core Vtiger application. For example, attempting to run PHP 7.x with legacy Vtiger 6.x will immediately break your instance with fatal syntax errors and removed MySQL functions.
Consult the table below to verify exact runtime compatibility for your specific Vtiger CRM deployment:
| Vtiger CRM Version | Supported PHP Versions | Recommended PHP Runtime | Deployment Recommendation |
|---|---|---|---|
| Vtiger 6.x | PHP 5.6 only | PHP 5.6.40 | Do not use PHP 7.x. Host in an isolated VPC or upgrade to Vtiger 8.x immediately. |
| Vtiger 7.1 to 7.4 | PHP 7.2, 7.3, 7.4 | PHP 7.4 | Use PHP 7.4 where possible. Apply strict firewall rules to protect EOL runtime. |
| Vtiger 7.5 | PHP 7.3, 7.4, 8.0, 8.1 | PHP 7.4 or 8.1 | Use PHP 7.4 or 8.1 depending on the compatibility of installed custom extensions. |
| Vtiger 8.0 | PHP 8.0, 8.1, 8.2 | PHP 8.1 or 8.2 | Transition to PHP 8.2 for long-term security and performance. |
| Vtiger 8.1 | PHP 8.1, 8.2 | PHP 8.2 | Use PHP 8.2 where possible. |
| Vtiger 8.2 | PHP 8.1, 8.2 | PHP 8.2 | Use PHP 8.2 where possible. |
| Vtiger 8.3 | PHP 8.1, 8.2 | PHP 8.2 | Use PHP 8.2 where possible. |
| Vtiger 8.4 | PHP 8.1, 8.2, 8.3 | PHP 8.2 or 8.3 | Use PHP 8.2 or 8.3 depending on custom extension and integration compatibility. |
Always audit and verify the compatibility of all installed custom modules (PDF makers, payment gateways, CTI Asterisk, WhatsApp integrators) before altering your server’s PHP runtime. Many older ionCube or SourceGuardian encoded extensions require PHP 7.4 and will fail to decrypt under PHP 8.x.
03. Mandatory & Recommended PHP Settings (php.ini)
Vtiger CRM handles massive data structures, deep relational queries, and complex AJAX grids. Default hosting configurations (like max_input_vars = 1000 or memory_limit = 128M) will silently truncate data and terminate scripts. Set the following directives in your php.ini:
| Setting | Minimum | Recommended | Operational Impact & Architecture Notes |
|---|---|---|---|
| error_reporting | E_WARNING & ~E_NOTICE | E_WARNING & ~E_NOTICE | Prevents PHP notices from corrupting AJAX/JSON responses or breaking PDF generator output. |
| display_errors | Off | Off for production | Must be Off in production to avoid path disclosure and header tampering. Use On only temporarily for local debugging. |
| file_uploads | On | On | Required for document attachments, CRM imports, company logos, and zip extension packages. |
| max_execution_time | 60 | 600 | Crucial for heavy database imports, report exports, schema updates, and PDF compilation. |
| max_input_time | 60 | 120 | Ensures larger multi-part web forms and module configuration submissions do not time out. |
| max_input_vars | 10000 | 10000 or higher | CRITICAL: Default 1,000 silently truncates settings in Module Layout Editor and picklist values! |
| memory_limit | 256M | 512M (1024M for large DBs) | Prevents script termination during bulk CSV exports, complex reports, and multi-page PDF generation. |
| post_max_size | 50M | 128M | Must strictly be set higher than upload_max_filesize. |
| upload_max_filesize | 5M | 50M or higher | Required for extension packages, large document attachments, and customer data imports. |
| output_buffering | On | On | Recommended for stable output handling and clean HTTP redirects. |
| short_open_tag | Off | Off | Recommended for standard, modern PHP compatibility. |
| default_charset | “UTF-8” | “UTF-8” | Ensures UTF-8 encoding across all data inputs and exports. |
Copy-Paste Production php.ini Configuration Snippet
Add or update these exact directives inside your server’s active php.ini configuration file:
; CRMPUNCH Recommended Vtiger CRM Production php.ini Directives
; ====================================================================
file_uploads = On
upload_max_filesize = 50M
post_max_size = 128M
max_execution_time = 600
max_input_time = 120
max_input_vars = 10000
memory_limit = 512M
output_buffering = On
default_charset = “UTF-8”
display_errors = Off
log_errors = On
error_reporting = E_WARNING & ~E_NOTICE
short_open_tag = Off
; Required PHP Extensions (Linux / Docker)
extension = gd
extension = imap
extension = mysqli
extension = mbstring
extension = bcmath
extension = curl
extension = zip
extension = intl
extension = soap
Windows / XAMPP Note: In Windows environments, extensions may be listed with a php_ prefix and .dll extension (for example: php_gd2.dll, php_imap.dll, php_mysqli.dll, or php_mbstring.dll). Ensure these lines are uncommented (remove the leading semicolon ;) in C:xamppphpphp.ini.
04. Obsolete & Legacy Directives to Avoid in Modern PHP (8.x)
When searching online for Vtiger setup guides, you may encounter outdated documentation referencing obsolete PHP directives. Do NOT blindly paste these legacy directives into modern PHP 8.x environments:
sql.safe_mode = Off
suhosin.simulation = On
allow_call_time_reference = On
These directives are obsolete, deprecated, or completely removed in modern PHP releases. Injecting them into a PHP 8.1, 8.2, or 8.3 configuration may cause PHP-FPM or Apache startup errors, rendering your web server completely unreachable.
05. Database Settings & MySQL Strict Mode Workaround
Modern MySQL (5.7, 8.0) and MariaDB (10.3+) ship with strict SQL modes enabled by default. Two specific SQL modes frequently conflict with Vtiger CRM core and extension queries:
ONLY_FULL_GROUP_BY: Causes fatal database errors in Vtiger reports, pivot charts, and dashboard widgets whenever a query selects columns not explicitly aggregated or grouped.STRICT_TRANS_TABLES: Rejects insert or update queries whenever optional fields in custom modules or web forms lack explicit default values.
To ensure flawless database operation, set the MySQL SQL mode to permissive or engine substitution only:
[mysqld]
sql_mode = “NO_ENGINE_SUBSTITUTION”
# Or set to empty:
# sql_mode = “”
After saving your MySQL configuration file, restart your database service (sudo systemctl restart mysql or sudo systemctl restart mariadb) and verify the active mode by running: SELECT @@GLOBAL.sql_mode; inside your database console.
06. Critical Configuration Settings in config.inc.php
Vtiger relies heavily on two primary path variables in its root configuration file. If either value is misconfigured, public image URLs, stylesheet assets, attachments, and extension license validations will break immediately:
$site_URL = ‘https://crm.yourdomain.com/’;
$root_directory = ‘/var/www/html/vtiger/’;
- Trailing Slash: Ensure
$site_URLalways concludes with a trailing forward slash (/). - Exact Filesystem Path:
$root_directorymust point to the physical, real path on the server filesystem. - HTTPS Consistency: If your server runs behind an SSL reverse proxy (e.g., Cloudflare or AWS ALB), ensure
$site_URLspecifieshttps://to prevent infinite redirect loops.
07. Recommended File & Folder Permissions (POSIX Hardening)
File permissions in Vtiger CRM have two essential components: ownership and permission modes. Setting wide-open 777 permissions is a critical security vulnerability that leaves your customer database exposed to local file inclusion (LFI) attacks. Instead, apply the following hardened permission standard:
Step 1: Set Correct User & Group Ownership
Assign ownership to the user under which your web server operates (www-data on Ubuntu/Debian, apache on RHEL/CentOS, or nginx):
Step 2: Apply Global Directory & File Baselines
Set all directories to 755 and all files to 644:
sudo find . -type d -exec chmod 755 {} ;
sudo find . -type f -exec chmod 644 {} ;
Step 3: Grant Selective Write Access to Runtime Folders
Grant write permissions (775) only to the specific folders Vtiger requires for logs, caches, document uploads, and module layouts:
For Vtiger 7.x & 8.x:
chmod -R 775 cache/ cron/ storage/ test/ user_privileges/
chmod -R 775 layouts/v7/modules/ modules/ logs/
For Vtiger 6.x (Legacy):
chmod -R 775 layouts/vlayout/modules/ logs/ modules/ storage/ test/ user_privileges/
For Vtiger 5.x (Legacy):
chmod -R 775 Smarty/cache/ Smarty/templates_c/ Smarty/templates/modules/
Step 4: Protect Critical Configuration Files
After completing installation or module updates, ensure configuration files remain securely writable by the web server process without exposing them to other server users:
chmod 664 user_privileges/audit_trail.php user_privileges/default_module_view.php user_privileges/enable_backup.php
08. Cron Scheduler: The Heartbeat of Vtiger CRM
In Vtiger CRM, the background cron scheduler is mandatory. Without an active cron runner executing every minute, essential automated operations will quietly stall:
Add the following crontab entry under the web server user (crontab -u www-data -e):
* * * * * php /var/www/html/vtiger/cron/vtigercron.php > /dev/null 2>&1
CLI PHP Version Check: If your server runs multiple PHP versions, specify the absolute path to your active PHP binary (e.g., /usr/bin/php8.2 /var/www/html/vtiger/cron/vtigercron.php). Verify this by running: php -v.
09. Hosting Environment Caveats: NAS & Shared Hosting Warnings
Not all hosting environments are equipped to run enterprise CRM software. We frequently see organizations struggle with two specific deployment types:
⚠️ Network Attached Storage (Synology / QNAP)
NAS appliances utilize proprietary, stripped-down Linux distributions with locked PHP binaries, restricted cron daemons, and non-standard permission schemes. Extension licensing and PDF compilers frequently fail on NAS hardware. For mission-critical operations, deploy on a standard Linux VPS instead.
❌ Low-End Shared cPanel Hosting
Budget shared hosting accounts enforce strict process memory ceilings, kill scripts exceeding 30–60 seconds, and lock max_input_vars to 1,000. These restrictions cause intermittent White Screens of Death and corrupted module records. Dedicated VPS instances (AWS, Hetzner, DigitalOcean) are strongly recommended.
10. Diagnostic Troubleshooting Matrix: 6 Server Misconfigurations & Fixes
| Symptom / Error Message | Root Cause | Verified Production Resolution |
|---|---|---|
| Fields fail to save in Module Layout Editor | max_input_vars ceiling reached (default 1000) |
Set max_input_vars = 10000 in php.ini and restart Apache / PHP-FPM. |
| SQL Error: Syntax error / ONLY_FULL_GROUP_BY | MySQL strict mode enabled on modern MySQL 8+ | Configure sql_mode = "NO_ENGINE_SUBSTITUTION" in my.cnf and restart MySQL. |
| Blank page (WSOD) when generating Quotes/Invoices | Missing mbstring extension or memory_limit exhaustion |
Install php-mbstring, increase memory_limit = 512M, and verify font permissions. |
| Mail Manager sync stalls / No emails fetched | Missing php-imap or inactive background cron runner |
Enable extension=imap in php.ini and verify vtigercron.php in crontab. |
| AJAX dropdowns display raw PHP Warning text | display_errors = On corrupts JSON/AJAX headers |
Set display_errors = Off and error_reporting = E_WARNING & ~E_NOTICE. |
| 403 Forbidden on uploaded documents & attachments | Incorrect permissions on storage/ folder |
Run chmod -R 775 storage/ and verify ownership is set to www-data. |
11. Frequently Asked Questions (FAQ)
Q1: Why is setting max_input_vars to 10000 mandatory for Vtiger CRM?
Vtiger’s settings screens—specifically the Module Layout Editor, custom field managers, and role permission matrices—transmit thousands of POST variables simultaneously. PHP’s default max_input_vars = 1000 truncates the payload without triggering a fatal error, resulting in corrupted permission matrices and lost layout fields.
Q2: How do I permanently disable ONLY_FULL_GROUP_BY in MySQL 8.0?
Open your MySQL server configuration file (/etc/mysql/my.cnf on Linux or C:xamppmysqlbinmy.ini on Windows), locate the [mysqld] block, and set sql_mode = "NO_ENGINE_SUBSTITUTION". Restart the MySQL service for the changes to persist across server reboots.
Q3: Can I run Vtiger 7.4 directly on PHP 8.2 or 8.3?
Out of the box, core Vtiger 7.4 was engineered for PHP 7.4 and contains numerous deprecated functions and dynamic property declarations that trigger fatal errors in PHP 8.2+. To run modern PHP 8.2+, you must either apply community compatibility patches or upgrade to Vtiger 8.x, which natively supports modern PHP runtimes.
Q4: What should I do if my Vtiger server runs on unpatched PHP 7.4 due to CVE-2026-109618?
Because PHP 7.4 is end-of-life and will not receive upstream fixes for CVE-2026-109618, immediately place your CRM server behind a Web Application Firewall (WAF) such as Cloudflare Enterprise or AWS WAF. Restrict access to known corporate IP addresses or an internal VPN. Contact CRMPUNCH to schedule an enterprise upgrade to Vtiger 8.x running on secure PHP 8.2.35+.
Q5: How can I confirm that my Vtiger cron job is executing successfully?
Log in to Vtiger CRM as an administrator, navigate to Settings > Automation > Scheduler, and inspect the “Last Scan Started” and “Last Scan Finished” columns. If timestamps match the current time, cron is active. You can also run the script manually via SSH: php /path/to/vtiger/cron/vtigercron.php to view live execution logs.
Q6: Can CRMPUNCH audit, optimize, and upgrade my Vtiger server environment?
Yes. CRMPUNCH provides turnkey server optimization, security hardening, PHP version upgrades, database indexing, and custom extension development. Whether resolving persistent WSOD crashes or planning a zero-downtime migration to Vtiger 8.x, our engineering team manages the entire technical lifecycle.
💬 Share Your Vtiger Server Experience
What server stack do you prefer for self-hosting Vtiger CRM—native Apache with PHP-FPM, containerized Docker, or cloud-managed platforms? What was your biggest hurdle with strict SQL modes or PHP version upgrades? Let us know in the comments below!
Need Professional Vtiger Server Optimization or Version Upgrades?
Don’t let server misconfigurations, slow queries, or unpatched PHP vulnerabilities risk your customer data. CRMPUNCH’s certified DevOps and CRM engineers deliver comprehensive server audits, security patches, high-availability clustering, and seamless zero-downtime upgrades.