Recently active topics

Thanks to Hiren and ​@Ben Weiner from Box for today’s overview of Permissions, also thanks to our guests who joined and participated in the Q&A. Please find the summary and recording below.   Modernizing Permissions for an AI-Powered World How can teams keep sensitive work secure without making folder structures harder to manage?  As organizations adopt AI and streamline work across teams, permissioning needs to keep pace. ​@Ben Weiner from Box  and Hiren Adesara discussed an upcoming capability to disable inherited permissions on a folder, giving teams more control over who can access sensitive content without reorganizing the broader folder structure. Demo: breaking permission inheritanceToday, access granted to a folder generally flows down through its hierarchy. The concept demo showed how an owner or co-owner could disable that inheritance on a specific folder, then manage access there separately.The example focused on a financial services team working across public markets an

Hi, store regulated customer documents in Box and need a written statement from Box Security for our vendor risk file regarding today’s PHP remote code execution vulnerabilities ( CVE-2026-109618 and CVE-2026-109619 ). Specifically:Does any component in Box’s service delivery path (upload handling, API, web application) run the PHP runtime (php-src, as opposed to HHVM)?   If so, has it been patched to the versions PHP released on October 21, and when was that completed?   Has Box identified any indication of exploitation attempts against its infrastructure prior to patching?A short written response would be appreciated. If Box has published or will publish a public advisory, a link to that is sufficient for questions 1 and 2. References:https://www.cve.org/CVERecord?id=CVE-2026-109618 https://www.cve.org/CVERecord?id=CVE-2026-109619 https://nvd.nist.gov/vuln/detail/CVE-2026-109618 https://nvd.nist.gov/vuln/detail/CVE-2026-109619 https://www.php.net/archive/2026.php#2026-10-20-1 https:/

Hello,I’m looking for suggestions on how to best share the details of a Box Shield alert with an affected user.  For instance, if I want to share the details of an anomalous download alert with the user, including the list of folders.  There’s no way to report on it or export the alert, right?Thanks in advance for any help!

Reopen this issue, because this is still happening now and hasn’t been solved.https://support.box.com/hc/en-us/community/posts/ [removed by moderator] -BOX-Drive-installs-cbfsconnect2017-sys-which-disables-support-for-Microsoft-s-Bypass-IO-directstorage Now, there are two NetworkProvider filters, cbfs20 and cbfsconnect2017. As I detail at the bottom, setting IoBlockLegacyFsFilters to 1 does not fix the problem any longer. You can delete cbfsconnect2017 entirely as I outline, and both Box and other filesystems work at the same time, but Box persistently re-adds it to the registry, so it is only a quick fix.If there is a way to permanently remove the older legacy one, it doesn’t appear to serve a purpose.

初めてBOXを利用しています。パスワードを設定したいのですが、できません。条件を確認し、クリアしていますがそれでもできません。どうしたらいいですか。

Hello,I have a free Box Individual account. I would like to create a user-authenticated OAuth 2.0 application under a separate free Developer account, then authorize it to upload personal backups to my existing Individual account.This would be a private, non-commercial integration used only by me. It would upload encrypted backup files, download them for integrity verification, and delete older backups according to a retention policy. It would not use Box AI or Box Sign.Before creating the Developer account, I would appreciate clarification on the following:1. Is this ongoing, private use permitted without purchasing a paid plan?2. Does the free Developer account expire or lose functionality after 30 days? The Developer Sandbox Management FAQ describes it as an initial 30-day evaluation, while the Free Developer Plan documentation describes a free plan without clearly stating an expiration date.3. Can an OAuth application owned by the Developer account be authorized by my existing free

We are planning to migrate approximately 40 TB of data to Box by June 2027. However, according to the topic below, there appears to be a data transfer limit of 1 TB per month.=======================================https://community.box.com/support-forum-47/hit-monthly-bandwidth-limit-despite-unlimited-storage-enterprice-plan-what-are-the-actual-upload-caps-35274?tid=35274&fid=47=======================================https://support.box.com/hc/en-us/articles/360044194313-Understanding-Box-Bandwidth-Limits=======================================If this limit applies to a single user subscription, transferring 40 TB would take 40 months, which would not meet our schedule. For example, if we purchase 10 Box user licenses and have each user transfer data separately, would it be possible to transfer 10 TB per month, allowing us to complete the migration of 40 TB in about 4 months? Alternatively, is there another subscription plan, licensing model, or migration approach that would allow us

I need to share a video with someone but keep getting this error.  What am I doing wrong?

Account Type: Enterprise PlusWe are currently migrating from SharePoint to Box using Shuttle. At around 7TB of files migrated, we received an email referencing the Fair Use Policy.Given that Enterprise Plus offers unlimited data, could you confirm if we might encounter any issues moving forward? We have already migrated 2024 and older data files and are planning to migrate 2025 files. We want to ensure it is safe to proceed despite receiving the Fair Use Policy notice.Thank you for your guidance. Email from Box below Dear Box admin,Thank you for your continued use of Box. We have detected a significant increase in bandwidth use to your account [removed by moderator] that exceeds the bandwidth limitations set forth in our Fair Use Policy (Section 1, article a) and violates the Box Terms of Service.As a result, to prevent abuse and ensure the integrity of the Box Service for all our users, we have implemented preventative measures to limit your bandwidth. We ask that you take the necessa

We recently changed the password for our end users, and now the account is requesting device verification and sending a verification code.  It did not do that before, and we do not have MFA set up on our account.  How can this be fixed so that our parents can log in, since they do not have access to the login email account?  

Does anyone have any security information about where Box is with mitigating PHP2Shell?  Our understanding is that Box does have PHP in use.  It would be great to know if they have this mitigated with a WAF or where they stand on rolling out patched PHP versions etc.  We’ve opened a support case and reached out to our account reps but we are not getting the level of technical detail we would like.

The current version of Box Drive includes compromised certificates. When can we expect a fix?https://emudhra.we-have-a-problem.com  

Hello, I followed instructions on another post about removing the user, re-adding, and checked all mail filter and firewall settings. The user is still not getting verification emails and cannot access Box. Can she be removed from the suppression list on Box’s end? The email in question is <removed personal information> Thank you 

Hello,I'm posting from a new account because I'm locked out of my original one.My old account was created years ago with an email address that no longer exists. I still know the password, but after logging in, Box sends a 2FA code to that deleted address, so I can't complete the login.The account holds over 1 GB of important content, mainly workshop recordings (.mp3 files).Could Box Support please help me verify my ownership and regain access, ideally by updating the login email to my current one? I'm happy to provide verification details privately.Thank you very much

Our BOX Admin delete users account for employees that are no longer employed at our firm.  However,   those users were listed as collaborators on various files.   We have no way to remove them as collaborators,  as the pull down box is grayed out, doesn’t allow us to “remove”.     How do we clean this up?    And yes,  I have updated browsers, and have cleared all cache and plug ins.    Thank you for your assistance.  Kathy Serksnis

While analyzing Box Drive logs, I noticed that the SHA1 value sent during upload appears to be identical to the SHA1 returned  after upload completion.Question:Does Box calculate the SHA1 hash again on the server side after the file is uploaded and stored?Or is file_version.sha1 simply derived from the hash value provided by the Box Drive client during upload?I am trying to understand whether the SHA1 returned by the API represents a server-verified hash of the stored object or merely a client-supplied value.If Box recalculates the SHA1 on the server side, at what stage of the upload workflow does the verification occur?The following log is from a file upload operation via BOX Drive. My question is whether the SHA1 value '99a2435649ffbb10e57cd0b912cd81865546d138' is recalculated and verified by the Box server after the upload, and then stored as the file's SHA1 value, or whether it is simply derived from the SHA1 value submitted by the Box Drive client.Any clarification from someone fa

企業様に資料を送付した際に、「BOXのセキュリティに関する規約が欲しい」と言われました。弊社は法人向けの「Business」を使用しています。貴社のセキュリティ規定等や使用する事への注意事項等の規定をいただけますと幸いです。よろしくお願いいたします。 

Hi ,I would like to retrieve the IDs of subfolders within a Box folder associated with a Salesforce record.I believe the box.Toolkit class's getFolderContents method might be useful for this purpose, but I'm not sure what information is returned in the FolderContents object.Could anyone clarify the following?What information does the FolderContents object contain? Is it possible to retrieve a folder ID by using the folder name as a key from the FolderContents object?Any advice or code examples would be greatly appreciated.Thank you in advance for your help!

I tried three times to purchase the upgrade for my space, but each time I get blocked with a message that says something like: “Your account needs further verification, please submit a ticket to customer support.” What should I do?

We are a voluntary organisation trying to find our way round Box to share files. We have recently upgraded to a paid version of Box but have now received the attached emails. I don’t know what this means or what I need to do to stop being charged etc  Can anybody help?? For info - we currently have 5 ‘Collaborators’ . Some of these do not use our organisations email address???

My account was accessed from another country. I've removed logged in devices, changed my password, and turned on 2FA but want to know if I can find out what files were copied from my Box account and what next steps I should do. I had some financially personal files in there. I've already compiled a to-do list from a personal perspective (such as fraud alerts, flagging my accounts, notifying credit agencies, etc.). I don't have a paid Box account so I can't directly open a support ticket.

Hi,Recently a customer required us to use BOX for files exchange and setup 2FAThen my 2 colleagues registered an account & setup 2FA with their China mobile phone, but now they can’t receive the code suddenly and also forgot the backup code. Can you help to reset their 2FA? so that they re-setup the 2FA with email or auth app.their account as below:<removed personal information><removed personal information>looking for the reply, it’s urgent.

Many thanks ​@NickAtBox for yesterdays overview of metadata and demo of metadata in Box. We had a technical glitch during the recording, however, you can access the full recording here Topics - full recording here0 mins - Metadata 101 What is metadata Different types of metadata How is metadata used6 mins 34 secs - Streamlining workflows with metadata templates in BoxBox metadata templates AI metadata autofill example Box folder level metadata Box file-request and metadata Box Relay and metadata example19 mins 25 secs - Future of metadata at BoxBox Apps Box Forms Box AI for metadata Box Doc Gen Topic - full recording here Slides 0 mins - Metadata 101 Agendawhat is metadatatypes of metadata  6 mins 34 secs - Streamlining workflows with metadata templates   AI Metadata autofill example   Demo of metadata at folder level   File request metadata example   Box relay metadata example   Metadata template creationmetadata at folder level  metadata fil

I TRY TO CHANGE MY PLAN AND IT SAYS: There was an error processing the request. Your account needs more verification. What do I have to do?