Help with ASM URL wildcard syntax

I also wasn't aware of the positional parameters, it looks helpful but I don't see how it can help in this scenario.

for example, if I'll create a URL with positional parameters like this:

Won't it will still allow a code injection where the wildcard is (marked red)?

Also, does this wildcard accepect one path level or any number of subfolders?

Anyway, I understand I'll need to add several more attack signatures in order to cover all bases.

Thank you Nikoolay and Mohamed for your inputs, they really helped me.