diff --git a/doc/news/_preparation_next_release.md b/doc/news/_preparation_next_release.md
index b76c516d787..9f7eeb971cb 100644
--- a/doc/news/_preparation_next_release.md
+++ b/doc/news/_preparation_next_release.md
@@ -150,9 +150,9 @@ The text below summarizes updates to the [C (and C++)-based libraries](https://w
 - <<TODO>>
 - <<TODO>>
 
-### <<Library>>
+### io
 
-- <<TODO>>
+- Check file flags for elektraIoFdSetFlags: file flags must be exactly one of: read only, write only or read write _(Richard Stöckl @Eiskasten)_
 - <<TODO>>
 - <<TODO>>
 
diff --git a/src/libs/io/io.c b/src/libs/io/io.c
index bdaa39e73af..82a57792ec9 100644
--- a/src/libs/io/io.c
+++ b/src/libs/io/io.c
@@ -15,6 +15,7 @@
 #include <kdblogger.h>
 #include <kdbprivate.h>
 
+#include <fcntl.h>
 #include <stdio.h>
 
 int elektraIoContract (KeySet * contract, ElektraIoInterface * ioBinding)
@@ -409,8 +410,15 @@ int elektraIoFdSetFlags (ElektraIoFdOperation * fdOp, int flags)
 		ELEKTRA_LOG_WARNING ("operation was NULL");
 		return 0;
 	}
-
-	fdOp->flags = flags; // TODO check if flags are valid
+	int rdwrFlags = flags & (O_RDONLY | O_WRONLY | O_RDWR);
+	// `open(2)` requires exactly one of these:
+	if (!(rdwrFlags == O_RDONLY || rdwrFlags == O_WRONLY || rdwrFlags == O_RDWR))
+	{
+		ELEKTRA_LOG_NOTICE ("file flags must be exactly one of: read only, write only or read write. actual flag is: %0d", flags);
+		return -1;
+	}
+	// since custom flags are allowed by `fcntl.h`, no further checks are required
+	fdOp->flags = flags;
 	return 1;
 }